CVE-2026-4424: Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing
Published Mar 19, 2026
·Updated
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.
Other sources
A Heap Out-of-Bounds Read vulnerability exists in the RAR archive processing logic of the libarchive library. The issue arises from improper validation of the LZSS sliding window size after transitions between compression methods (PPMd and LZSS). Due to a mismatch between the allocated buffer size and the expected dictionary size, the copyfromlzsswindow() function performs out-of-bounds memory reads. This allows a specially crafted RAR archive to leak heap memory through the archivereaddata() API before integrity checks (CRC) are enforced. The vulnerability can be exploited remotely without authentication or user interaction in systems that automatically process archives, leading to disclosure of sensitive information.
— Red Hat
Accessibility. This issue was addressed through improved state management.
— Apple
Accounts Framework. This issue was addressed with improved data protection.
— Apple
Accounts. A parsing issue in the handling of directory paths was addressed with improved path validation.
— Apple
Accounts. An access issue was addressed with additional sandbox restrictions.
— Apple
Credit
Rosyna Keller(Totally Not Malicious Software), Rahul Raj, Seonung Park, ALTV!ST (altvi.st/), David Strnadel, Franco Belman at Blackwing Intelligence, YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Anton Pakhunov, Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), Daniel Febrero, Daniel Williams, Anonymous(TrendAI Zero Day Initiative), Mathis Mansière, an anonymous researcher, James Duffy@@0x4A616D657344, Huỳnh Tấn Ngàn, Ilya Andr (andrd3v)(Positive Technologies), Stanislav Jelezoglo, Redon Gashi, Michael DePlante@@izobashi(TrendAI Zero Day Initiative), Arni Hardarson, Jonathan Alush-Aben, Peter Malone, 진규정 (Gyujeong Jin, @@G1uN4sh, PETOWORKS의 Bugeun Choi@@Bugeun, Geonha Lee@@leegn4a, Billy Jheng Bing Jhong(STAR Labs SG Pte), Pan Zhenpeng@@Peterpan0927(STAR Labs SG Pte), Ashish Kunwar, Hiroki Imai (LAC Co., Ltd.), hxr1, f0r(MurphySec), Feng Xue(ThreatBook), XGPT(ThreatBook), Mahmoud Abdelmoniem, Wang Yu, Lyutoon, DARKNAVY@@DarkNavyOrg, Fábio Luís@@scanpt, Nicolas Rabrenovic, Pasquale Scola(STAR Labs SG Pte), Gor Aleksanyan, impost0r (ret2plt)(Appknox), Ruslan Dautov(Appknox), Aleksandr Tarasikov(Appknox), jay(Appknox), Dhiyanesh Selvaraj@@redroot97(Appknox), Vinay Kumar Rasala (Xplo8E)(Appknox), Lyutoon(STAR Labs SG Pte), DongJun Kim (smlijun) with UIUC(STAR Labs SG Pte), Hwiwon Lee (hwiwonl) with UIUC(STAR Labs SG Pte), Jongseong Kim (nevul37) with UIUC(STAR Labs SG Pte), Younggi Park (grill66) with UIUC(STAR Labs SG Pte), Peter Malone(STAR Labs SG Pte), an anonymous researcher(STAR Labs SG Pte), Hari Shanmugam (The Hxr1)(STAR Labs SG Pte), Marco Grassi, Dun, Daniele Castronovo, Michal Kosiorek, Josh Maine(Calif), Ruslan Dautov(Baidu Security), 재영 정(Baidu Security), (Rao Ali Nawaz)@@rootxran(Baidu Security), Chanwit Muenprakoddee (ChemIndy)(Baidu Security), an anonymous researcher(Baidu Security), Ye Zhang@@VAR10CK(Baidu Security), Franco Belman at Blackwing Intelligence(Calif), Christian Figueroa(Calif), Johnny Franks@@zeroxjf(Calif), Ashmit Sharma & Atul RV(Calif), Peter Malone(Calif), Muhamad Syaiful(Calif), Muneeb Amin Bhat(Calif), Dhiyanesh Selvaraj@@redroot97(Calif), Ali Marzouq(Calif), Bountyy Oy - Mihalis Haatainen(Calif), Huy Nguyen@@34306(Calif), Eddy Tsalolikhin, beist(ASU SEFCOM), Adam Doupé(ASU SEFCOM), Dun(STAR Labs SG Pte), Johnny Franks@@zeroxjf, Asjid Kalam@@odinshell, impost0r (ret2plt), Hyunwoo Kim@@v4bel, Ryan Hileman via Xint Code (xint.io), Vladislav Shevchenko (Positive Technologies)(Baidu Security), N.M.Praveen Nawarathne@@zblockrat, Lukas Gerlach, CVE-2026-4424, Tristan Madani@@TristanInSec(Talence Security), Daisuke Hatakeyama Research)@@SYZD, Richard Zana(Nosebeard Labs), Andreas Jaegersberger & Ro Achterberg(Nosebeard Labs), stratan@@5tratan, wh0am1i, Francisco Knabe, 彦辰, dr3dd, Nathaniel Oh@@calysteon, Gurpreet Shergill, Merrick Hare, Drinor Selmanaj (Sentry), Khai Tran, John Lussier, Rhyru9, Kwak Kiyong, Song Nuri, stratan@@5tratan(Almamater Technologies), Josef Korbel (Citadelo), Tristan Madani, CVE-2026-43709, Юлия Мерцалова, Tommy DeVoss@@thedawgyg(Braze Security Team), Kagami Rosylight(Mozilla), Gia Bui@@yabeow(Calif), 杉山 壮太(Z), lattice(Z), Behzad Najjarpour Jabbari@@_G4ru_(Z), Junyeong Lee(Z), Mooth.ai(Z), OGINOME Tomohito(Z), Using GLM(Z), Luke Francis, Soyeon Park, Amy Burnett, Utkarsh Pal, Ignacio Sanmillan@@ulexec, Kwak Kiyong(Talence Security), Song nuri(Talence Security), Milad Nasr, Nicholas Carlini with Claude, Anthropic, Jody Ritonga, Behzad Najjarpour Jabbari@@_G4ru_, OpenAI Codex Security - Amy Burnett, Aaron Grattafiori - NVIDIA AI Red Team, Vitaly Simonovich, Christian Meurer Xavier, Heiko Kiesel(SEEMOO), TU Darmstadt, Nan Wang@@eternalsakura13, Mateusz Krzywicki (iVerify.io)(Braze Security Team), dr3dd(Braze Security Team), Brian Carpenter, Josef Korbel, OGINOME Tomohito, Idan Masas, Shaheen Fazim, CVE-2026-28979, Irvin Wang, Rodolphe Brunetti@@eisw0lf(Lupus Nova), Arni Hardarson (Neonix Security), CVE-2026-3784, CVE-2026-3783, Niels Hofmans, Manuel Fernandez (Stackhopper Security), 이재영, Somair Ansar(Calif), Abhijeet Singh (linkedin.com/in/abhiunix/), Omar Cerrito, Jian Zhou, Ye Zhang, Koh M. Nakagawa@@tsunek0h(FFRI Security Inc), Stuart Wallace, Jorge Welch@@jorgwelch, Adam Franke(CyStack), Ashish Kunwar(CyStack), Trung Nguyen@@everping(CyStack), Dave G., Pinak Oza, Robert Mindo, tamdao, David Ige - Beryllium Security, Pavan Nallamothu, Jared Reyes, Richard Zana, Gergely Kalman@@gergely_kalman, Csaba Fitzl@@theevilbit(Iru), Rajdip Dey Sarkar, Matthew Schneider, Dallas Dubs(Nosebeard Labs), Aaron Grattafiori - NVIDIA AI Red Team(Nosebeard Labs), XBreach.ai(Nosebeard Labs), HvxyZLF, Lance Cain - Offensive Security Engineer, SpecterOps Inc., Gil Portnoy & Henry, Anthony Laou Hine Tsuei@@anarcheuz, Ayaan Ahmad, erdene-och Byambabayar, Alexandre Soleiman, Alexander Tarasikov, Ruslan Dautov, Atul R V & Ashmit Sharma, Hcamael, 章鱼哥 （aipyaipy.com）@@aipy, Aswin Kumar Gokulakannan, Surya Narayan Kushwaha, Cem Onat Karagun, Igor Ushakov, Wang Yu(STAR Labs SG Pte), Ji'an Zhou, Mingxuan Yang, Calif Research, Ernesto Martínez García, Amy (amys.website), He Wei (ギカク)(aipyaipy), 章鱼哥@@aipy(aipyaipy), Jex Amro, yk lin@@pixiepointsec, Robert Tran, Mickey Jin@@patch1t, Matej Moravec@@MacejkoMoravec, Sindre Sorhus, Hcamael(Stripe), 章鱼哥 （aipyaipy.com）@@aipy(Stripe), JC Alvarado(Stripe), Jacob Hazak, @@pixiepointsec, Ilya Andr (andrd3v), Asaf Cohen, Junming C.(Chapoly1305), Alfredo Pesoli@@__rev(Bynar), wdszzml, Atuin Automated Vulnerability Discovery Engine, Bob Gendler(the National Institute of Standards), Technology, Vivek Dhar, ASI (RM) in Border Security Force, FTR HQ BSF Kashmir, Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Kitten Food, Calif.io in collaboration with Claude, Anthropic Research, Tien-Chih Lin(CyCraft Technology), Bruce Dang(Calif), Jonathan Bar Or@@yo_yo_yo_jbo, Stanislav Jelezoglo(Positive Technologies), Gandalf4a(PKU), Dhiyanesh Selvaraj@@redroot97, hxr1(STAR Labs SG Pte), Hiroki Imai (LAC Co.(STAR Labs SG Pte), Ltd.)(STAR Labs SG Pte), Mahmoud Abdelmoniem(ThreatBook), Hyunwoo Kim@@v4bel(ThreatBook), Vladislav Shevchenko (Positive Technologies)(STAR Labs SG Pte), Kirin@@Pwnrin(Fudan University), LFY@@secsys(Fudan University), Prathamesh Walunj, Atul R V, Dan Raviv, wdszzml(Bynar), Atuin Automated Vulnerability Discovery Engine(Bynar)
Affected Software
25 affected componentsFixes available
Libarchive libarchive
Microsoft azl3 libarchive 3.7.7-5
Microsoft cbl2 libarchive 3.6.1-9
Libarchive libarchive
redhat Hardened Images
redhat OpenShift Container Platform=4.0
redhat OpenShift Container Platform=4.16
redhat Openshift Container Platform For Arm64=4.16
redhat Openshift Container Platform For Power=4.16
redhat Enterprise Linux=6.0
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
redhat Enterprise Linux=9.0
redhat Enterprise Linux=10.0
redhat Enterprise Linux Server Aus=8.2
redhat Enterprise Linux Server Aus=8.4
debian/libarchive<=3.4.3-2+deb11u1, <=3.6.2-1+deb12u2
3.4.3-2+deb11u43.6.2-1+deb12u43.7.4-4+deb13u13.8.7-1
IBM MQ Operator<=SC2: v3.2.0 - v3.2.23
CD: v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1
LTS: v2.0.0 - 2.0.29
IBM supplied MQ Advanced container images<=SC2: 9.4.0.6-r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2
Apple visionOS<26.6
26.6
Apple iOS<26.6
26.6
Apple iPadOS<26.6
26.6
Apple macOS Tahoe<26.6
26.6
Apple macOS Sequoia<15.7.8
15.7.8
Apple macOS Sonoma<14.8.8
14.8.8
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libarchiveto a version that resolves this vulnerability.Fixed in 3.4.3-2+deb11u4Fixed in 3.6.2-1+deb12u4Fixed in 3.7.4-4+deb13u1Fixed in 3.8.7-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.7.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.8.8
Event History
Mar 19, 2026
Data Sourced
via Red Hat·12:25 PM
DescriptionSeverityAffected Software
CVE Published
via MITRE·01:50 PM
Data Sourced
via MITRE·01:50 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeaknessAffected Software
Mar 25, 2026
Data Sourced
via Microsoft·08:02 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:02 AM
DescriptionSeverity
Updated
via Microsoft·08:02 AM
Affected Software
May 15, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
May 21, 2026
Data Sourced
via Launchpad·07:49 PM
Description
Data Sourced
via Debian·07:49 PM
DescriptionAffected Software
May 22, 2026
Data Sourced
via Ubuntu·07:48 PM
RemedyDescriptionSeverityAffected Software
Jul 27, 2026
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
Description
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
Affected Software
Updated
via Apple·12:00 AM
DescriptionAffected Software
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-64733
- CVE-2026-43801
- CVE-2026-64725
- CVE-2026-43730
- CVE-2026-64747
- CVE-2026-64707
- CVE-2026-43813
- CVE-2026-64746
- CVE-2026-64734
- CVE-2026-43673
- CVE-2026-43744
- CVE-2026-43803
- CVE-2026-43711
- CVE-2026-43714
- CVE-2026-64742
- CVE-2026-43796
- CVE-2026-64692
- CVE-2026-43780
- CVE-2026-64716
- CVE-2026-64758
- CVE-2026-64754
- CVE-2026-64693
- CVE-2026-64749
- CVE-2026-43778
- CVE-2026-64709
- CVE-2026-64735
- CVE-2026-43739
- CVE-2026-43816
- CVE-2026-43822
- CVE-2026-64729
- CVE-2026-64700
- CVE-2026-43799
- CVE-2026-43817
- CVE-2026-43724
- CVE-2026-43769
- CVE-2026-43810
- CVE-2026-64775
- CVE-2026-39868
- CVE-2026-64751
- CVE-2026-64721
- CVE-2026-4424
- CVE-2026-64739
- CVE-2026-43706
- CVE-2026-43703
- CVE-2026-64743
- CVE-2026-64724
- CVE-2026-43723
- CVE-2026-43807
- CVE-2026-43729
- CVE-2026-64772
- CVE-2026-64771
- CVE-2026-64774
- CVE-2026-64770
- CVE-2026-64769
- CVE-2026-64768
- CVE-2026-43812
- CVE-2026-64741
- CVE-2026-64766
- CVE-2026-64765
- CVE-2026-64764
- CVE-2026-64763
- CVE-2026-43704
- CVE-2026-43740
- CVE-2026-43735
- CVE-2026-64713
- CVE-2026-43734
- CVE-2026-43726
- CVE-2026-43709
- CVE-2026-43742
- CVE-2026-43699
- CVE-2026-64730
- CVE-2026-43727
- CVE-2026-64783
- CVE-2026-43725
- CVE-2026-43663
- CVE-2026-39872
- CVE-2026-43712
- CVE-2026-64728
- CVE-2026-43731
- CVE-2026-43715
- CVE-2026-64757
- CVE-2026-43713
- CVE-2026-43708
- CVE-2026-43707
- CVE-2026-43705
- CVE-2026-43701
- CVE-2026-43745
- CVE-2026-43700
- CVE-2026-43804
- CVE-2026-43732
- CVE-2026-43676
- CVE-2026-43821
- CVE-2026-43720
- CVE-2026-64718
- CVE-2026-43721
- CVE-2026-43718
- CVE-2026-64719
- CVE-2026-28979
- CVE-2026-64726
- CVE-2026-64732
- CVE-2026-28928
- CVE-2026-43776
- CVE-2026-43811
- CVE-2026-43797
- CVE-2026-3784
- CVE-2026-3783
- CVE-2026-43753
- CVE-2026-64740
- CVE-2026-43818
- CVE-2026-43805
- CVE-2026-43814
- CVE-2026-28931
- CVE-2026-64720
- CVE-2026-28973
- CVE-2026-43733
- CVE-2026-64722
- CVE-2026-64711
- CVE-2026-43800
- CVE-2026-64755
- CVE-2026-43819
- CVE-2026-43749
- CVE-2026-64767
- CVE-2026-23918
- CVE-2026-64695
- CVE-2026-43781
- CVE-2026-64737
- CVE-2026-43748
- CVE-2026-43681
- CVE-2026-43672
- CVE-2026-43763
- CVE-2026-64702
- CVE-2026-64762
- CVE-2026-64698
- CVE-2026-43756
- CVE-2026-43693
- CVE-2026-43775
- CVE-2026-43759
- CVE-2026-43802
- CVE-2026-64710
- CVE-2026-39875
- CVE-2026-43698
- CVE-2026-43758
- CVE-2026-64708
- CVE-2026-64776
- CVE-2026-64694
- CVE-2026-43747
- CVE-2026-28945
- CVE-2026-43793
- CVE-2026-64691
- CVE-2026-43682
- CVE-2026-28981
- CVE-2026-43773
- CVE-2026-43767
- CVE-2026-43764
- CVE-2026-64697
- CVE-2026-43710
- CVE-2026-43782
- CVE-2026-64744
- CVE-2026-28982
- CVE-2026-43809
- CVE-2026-43757
- CVE-2026-64727
- CVE-2026-64723
- CVE-2026-43754
- CVE-2026-43766
- CVE-2026-64738
- CVE-2026-43806
- CVE-2026-28911
- CVE-2026-43771
- CVE-2026-43772
- CVE-2026-28912
- CVE-2026-43765
- CVE-2026-64731
- CVE-2026-43694
- CVE-2026-39874
- CVE-2026-43792
- CVE-2026-43779
- CVE-2026-43777
- CVE-2026-43760
- CVE-2026-43728
- CVE-2026-43755
- CVE-2026-64745
- CVE-2026-39873
- CVE-2026-64696
- CVE-2026-64704
- CVE-2026-43774
- CVE-2026-43770
- CVE-2026-43768
- CVE-2026-64703
- CVE-2026-64699
- CVE-2026-43750
- CVE-2026-28932
- CVE-2026-28849
- CVE-2026-28936
- CVE-2026-43738
- CVE-2026-28926
- CVE-2025-43325
- CVE-2026-43661
- CVE-2026-39877
- CVE-2026-43722
- CVE-2026-20672
- CVE-2026-28983
- CVE-2026-28900
- CVE-2026-43653
- CVE-2026-28961
- CVE-2026-28896
- CVE-2026-43665
- CVE-2026-28914
Frequently Asked Questions
1
What is the severity of CVE-2026-4424?
CVE-2026-4424 is classified as a medium severity vulnerability due to its potential to lead to information disclosure.
2
How do I fix CVE-2026-4424?
To fix CVE-2026-4424, update to the latest version of libarchive that addresses this vulnerability.
3
What products are affected by CVE-2026-4424?
CVE-2026-4424 specifically affects the libarchive library used for processing RAR archives.
4
What type of vulnerability is CVE-2026-4424?
CVE-2026-4424 is an information disclosure vulnerability caused by a heap out-of-bounds read.
5
What can an attacker achieve with CVE-2026-4424?
An attacker exploiting CVE-2026-4424 could potentially read sensitive information from the heap memory.