7.5High

CVE-2026-4424Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Suppo… Published: 2026-03-19 16:50 (8 months ago)

Description

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

Weakness (CWE): CWE-125

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
ai inference server	3.2	—
ai inference server	3.3	—
cert manager	1.17	—
cert manager	1.18	—
cert manager	1.20	—
discovery	2	—
enterprise linux	8	—
enterprise linux	9	—
insights proxy	1.5	—
libarchive	libarchive	—
openshift	4.12	—
openshift	4.13	—
openshift	4.14	—
openshift	4.15	—
openshift	4.16	—
openshift	4.17	—
openshift	4.18	—
openshift	4.19	—
Red Hat	Cert Manager support for Red Hat OpenShift release 1.17	all versions
Red Hat	Cert Manager support for Red Hat OpenShift release 1.18	all versions
Red Hat	Cert Manager support for Red Hat OpenShift release 1.20	all versions
redhat	enterprise linux	6.0
redhat	enterprise linux server aus	8.2
redhat	hardened images	—
redhat	openshift container platform	4.0
redhat	openshift container platform for arm64	4.16
redhat	openshift container platform for power	4.16
Red Hat	Red Hat AI Inference Server 3.2	all versions
Red Hat	Red Hat AI Inference Server 3.3	all versions
Red Hat	Red Hat Discovery 2	all versions
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	all versions
Red Hat	Red Hat Hardened Images	all versions
Red Hat	Red Hat Insights proxy 1.5	all versions
Red Hat	Red Hat OpenShift Container Platform 4.12	all versions
Red Hat	Red Hat OpenShift Container Platform 4.13	all versions
Red Hat	Red Hat OpenShift Container Platform 4.14	all versions
Red Hat	Red Hat OpenShift Container Platform 4.15	all versions
Red Hat	Red Hat OpenShift Container Platform 4.16	all versions
Red Hat	Red Hat OpenShift Container Platform 4.17	all versions
Red Hat	Red Hat OpenShift Container Platform 4.18	all versions
Red Hat	Red Hat OpenShift Container Platform 4.19	all versions
Red Hat	Red Hat Update Infrastructure 5	all versions
Red Hat	RHEL-8 based Middleware Containers	all versions
rhel aus	8.2	—
rhel aus	8.4	—
rhel aus	8.6	—
rhel e4s	8.6	—
rhel e4s	8.8	—
rhel e4s	9.0	—
rhel e4s	9.2	—
rhel eus	9.4	—
rhel eus	9.6	—
rhel eus long life	8.4	—
rhel tus	8.6	—
rhel tus	8.8	—
rhosemc	1.0	—
rhui	5	—

References and patches

RHSA-2026:10065 vendor-advisoryThird Party Advisory
RHSA-2026:10097 vendor-advisoryThird Party Advisory
RHSA-2026:11768 vendor-advisoryThird Party Advisory
RHSA-2026:12071 vendor-advisory
RHSA-2026:12274 vendor-advisory
RHSA-2026:13812 vendor-advisory
RHSA-2026:14773 vendor-advisory
RHSA-2026:14937 vendor-advisory
RHSA-2026:15087 vendor-advisory
RHSA-2026:16008 vendor-advisory
RHSA-2026:16009 vendor-advisory
RHSA-2026:16030 vendor-advisory
RHSA-2026:16174 vendor-advisory
RHSA-2026:17596 vendor-advisory
RHSA-2026:19724 vendor-advisory
RHSA-2026:19725 vendor-advisory
RHSA-2026:20040 vendor-advisory
RHSA-2026:21690 vendor-advisory
RHSA-2026:25096 vendor-advisory
RHSA-2026:72502 vendor-advisory
RHSA-2026:82304 vendor-advisory
RHSA-2026:82322 vendor-advisory
RHSA-2026:82347 vendor-advisory
RHSA-2026:82354 vendor-advisory
RHSA-2026:82372 vendor-advisory
RHSA-2026:82857 vendor-advisory
RHSA-2026:82888 vendor-advisory
RHSA-2026:8492 vendor-advisoryThird Party Advisory
RHSA-2026:8510 vendor-advisoryThird Party Advisory
RHSA-2026:8517 vendor-advisoryThird Party Advisory
RHSA-2026:8521 vendor-advisoryThird Party Advisory
RHSA-2026:8534 vendor-advisoryThird Party Advisory
RHSA-2026:8864 vendor-advisoryThird Party Advisory
RHSA-2026:8865 vendor-advisoryThird Party Advisory
RHSA-2026:8866 vendor-advisoryThird Party Advisory
RHSA-2026:8867 vendor-advisoryThird Party Advisory
RHSA-2026:8873 vendor-advisoryThird Party Advisory
RHSA-2026:8908 vendor-advisoryThird Party Advisory
RHSA-2026:8944 vendor-advisoryThird Party Advisory
RHSA-2026:9026 vendor-advisoryThird Party Advisory
RHSA-2026:9592 vendor-advisoryThird Party Advisory
RHSA-2026:9832 vendor-advisoryThird Party Advisory
https://access.redhat.com/security/cve/CVE-2026-4424 vdb-entryThird Party Advisory
RHBZ#2449006 issue-trackingIssue TrackingThird Party Advisory
https://github.com/libarchive/libarchive/pull/2898 Issue TrackingThird Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4424.json

CPE matches (NVD) (13)

cpe:2.3:a:libarchive:libarchive:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.16:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.16:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.16:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*

CVSS score

7.5High

Source: redhat · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

All scores (4)

cna	CVSS 3.1	7.5High
redhat-SADP	CVSS 3.1	7.5High
secalert@redhat.com	CVSS 3.1	7.5High
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	CVSS 3.1	7.5High

EPSS (chance of exploitation in 30 days)

1.24%

higher than 70% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: partial

Timeline

ID reserved2026-03-19
Published2026-03-19 16:50
Reached IP-DB2026-10-24 23:49
Last updated2026-11-05 02:17

Assigned by (CNA): redhat
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Red Hat Enterprise Linux

6.2Medium

CVE-2026-128886 yesterday

Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because th…

5.5Medium

CVE-2026-110330 yesterday

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8High

CVE-2026-110331 yesterday

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…

6.2Medium

CVE-2026-128987 yesterday

Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…

5.5Medium

CVE-2026-128885 yesterday

Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize

Red Hat Red Hat Enterprise Linux 10

A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…

8.8High

CVE-2026-18379 2 days ago

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…