CVE-2026-4424
published 2026-03-19CVE-2026-4424: A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS…
PriorityP350high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.88%
55.4th percentile
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libarchive | — | — |
| msrc | azl3_libarchive_3.7.7-4_on_azure_linux_3.0 | — | — |
| msrc | cbl2_libarchive_3.6.1-8_on_cbl_mariner_2.0 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform_for_arm64 | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| ubuntu | libarchive | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libarchive vulnerabilities
vendor_ubuntu·2026-05-21·CVSS 7.5
CVE-2026-4426 [HIGH] libarchive vulnerabilities
Title: libarchive vulnerabilities
Summary: Several security issues were fixed in libarchive.
It was discovered that libarchive incorrectly handled certain RAR
archives. An attacker could possibly use this issue to cause an
out-of-bounds read via a crafted RAR archive, leading to sensitive
memory disclosure. (CVE-2026-4424)
It was discovered that libarchive incorrectly handled certain ISO files.
An attacker could possibly use this issue to cause incorrect memory
allocation via a crafted ISO file, leading to a denial of service.
(CVE-2026-4426)
It was discovered that libarchive incorrectly handled block pointer
allocation in zisofs on 32-bit systems. An attacker could possibly use
this issue to cause a heap buffer overflow via a crafted ISO9660 image,
possibly leading to arbitrary code e
Red Hat
libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing
vendor_redhat·2026-03-19·CVSS 7.5
CVE-2026-4424 [HIGH] CWE-125 libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing
libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a s
Microsoft
Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing
vendor_msrc·2026-03-10·CVSS 7.5
CVE-2026-4424 [HIGH] CWE-125 Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing
Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Debian
CVE-2026-4424: libarchive - A flaw was found in libarchive. This heap out-of-bounds read vulnerability exist...
vendor_debian·2026·CVSS 7.5
CVE-2026-4424 [HIGH] CVE-2026-4424: libarchive - A flaw was found in libarchive. This heap out-of-bounds read vulnerability exist...
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
OSV
CVE-2026-4424: A flaw was found in libarchive
osv·2026-03-19·CVSS 7.5
CVE-2026-4424 [HIGH] CVE-2026-4424: A flaw was found in libarchive
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.
GHSA
GHSA-c75f-55f6-f63q: A flaw was found in libarchive
ghsa_unreviewed·2026-03-19
CVE-2026-4424 [HIGH] CWE-125 GHSA-c75f-55f6-f63q: A flaw was found in libarchive
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-4424 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-4424 [MEDIUM] CVE-2026-4424 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-4424 :
Linux Debian vulnerability analysis and mitigation
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.
Source : NVD
## 7.5
Score
Published March 19, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Linux Debian
Linux Ubuntu
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 38.7
Exploitation Probabi
Bugzilla
CVE-2026-4424 libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing
bugzilla·2026-03-19·CVSS 7.5
CVE-2026-4424 [HIGH] CVE-2026-4424 libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing
CVE-2026-4424 libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing
A Heap Out-of-Bounds Read vulnerability exists in the RAR archive processing logic of the libarchive library. The issue arises from improper validation of the LZSS sliding window size after transitions between compression methods (PPMd and LZSS). Due to a mismatch between the allocated buffer size and the expected dictionary size, the copy_from_lzss_window() function performs out-of-bounds memory reads. This allows a specially crafted RAR archive to leak heap memory through the archive_read_data() API before integrity checks (CRC) are enforced. The vulnerability can be exploited remotely without authentication or user interaction in systems that automatically process archives
https://access.redhat.com/errata/RHSA-2026:10065https://access.redhat.com/errata/RHSA-2026:10097https://access.redhat.com/errata/RHSA-2026:11768https://access.redhat.com/errata/RHSA-2026:12071https://access.redhat.com/errata/RHSA-2026:12274https://access.redhat.com/errata/RHSA-2026:13812https://access.redhat.com/errata/RHSA-2026:14773https://access.redhat.com/errata/RHSA-2026:14937https://access.redhat.com/errata/RHSA-2026:15087https://access.redhat.com/errata/RHSA-2026:16008https://access.redhat.com/errata/RHSA-2026:16009https://access.redhat.com/errata/RHSA-2026:16030https://access.redhat.com/errata/RHSA-2026:16174https://access.redhat.com/errata/RHSA-2026:17596https://access.redhat.com/errata/RHSA-2026:19724https://access.redhat.com/errata/RHSA-2026:19725https://access.redhat.com/errata/RHSA-2026:20040https://access.redhat.com/errata/RHSA-2026:21690https://access.redhat.com/errata/RHSA-2026:25096https://access.redhat.com/errata/RHSA-2026:8492https://access.redhat.com/errata/RHSA-2026:8510https://access.redhat.com/errata/RHSA-2026:8517https://access.redhat.com/errata/RHSA-2026:8521https://access.redhat.com/errata/RHSA-2026:8534https://access.redhat.com/errata/RHSA-2026:8864https://access.redhat.com/errata/RHSA-2026:8865https://access.redhat.com/errata/RHSA-2026:8866https://access.redhat.com/errata/RHSA-2026:8867https://access.redhat.com/errata/RHSA-2026:8873https://access.redhat.com/errata/RHSA-2026:8908https://access.redhat.com/errata/RHSA-2026:8944https://access.redhat.com/errata/RHSA-2026:9026https://access.redhat.com/errata/RHSA-2026:9592https://access.redhat.com/errata/RHSA-2026:9832https://access.redhat.com/security/cve/CVE-2026-4424https://bugzilla.redhat.com/show_bug.cgi?id=2449006https://github.com/libarchive/libarchive/pull/2898https://access.redhat.com/errata/RHSA-2026:10065https://access.redhat.com/errata/RHSA-2026:10097https://access.redhat.com/errata/RHSA-2026:11768https://access.redhat.com/errata/RHSA-2026:12071https://access.redhat.com/errata/RHSA-2026:12274https://access.redhat.com/errata/RHSA-2026:13812https://access.redhat.com/errata/RHSA-2026:14773https://access.redhat.com/errata/RHSA-2026:14937https://access.redhat.com/errata/RHSA-2026:15087https://access.redhat.com/errata/RHSA-2026:16008https://access.redhat.com/errata/RHSA-2026:16009https://access.redhat.com/errata/RHSA-2026:16030https://access.redhat.com/errata/RHSA-2026:16174https://access.redhat.com/errata/RHSA-2026:17596https://access.redhat.com/errata/RHSA-2026:19724https://access.redhat.com/errata/RHSA-2026:19725https://access.redhat.com/errata/RHSA-2026:20040https://access.redhat.com/errata/RHSA-2026:21690https://access.redhat.com/errata/RHSA-2026:25096https://access.redhat.com/errata/RHSA-2026:8492https://access.redhat.com/errata/RHSA-2026:8510https://access.redhat.com/errata/RHSA-2026:8517https://access.redhat.com/errata/RHSA-2026:8521https://access.redhat.com/errata/RHSA-2026:8534https://access.redhat.com/errata/RHSA-2026:8864https://access.redhat.com/errata/RHSA-2026:8865https://access.redhat.com/errata/RHSA-2026:8866https://access.redhat.com/errata/RHSA-2026:8867https://access.redhat.com/errata/RHSA-2026:8873https://access.redhat.com/errata/RHSA-2026:8908https://access.redhat.com/errata/RHSA-2026:8944https://access.redhat.com/errata/RHSA-2026:9026https://access.redhat.com/errata/RHSA-2026:9592https://access.redhat.com/errata/RHSA-2026:9832https://access.redhat.com/security/cve/CVE-2026-4424https://bugzilla.redhat.com/show_bug.cgi?id=2449006https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4424.json
2026-03-19
Published