ZeroDay Findings
Sign inSign up

Findings

CVE-2026-4424

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

Published Mar 19, 2026 · updated Oct 14, 2026 · Red Hat Red Hat Enterprise Linux 10

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 19, 2026 · Catalog

    Detected

    A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication

  2. Oct 14, 2026 · Catalog

    Updated

    A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication

Affected

  • vendor Red Hat Red Hat Enterprise Linux 10version unspecified
  • vendor Red Hat Red Hat Enterprise Linux 10.0 Extended Update Supportversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Supportversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8version unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Supportversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportversion unspecified

Sources

  • CIRCL Vulnerability LookupCVE-2026-4424

    A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specia

    vulnerability.circl.lu
  • CVE.orgCVE-2026-4424

    Official CVE identifier

    cve.org

References