CVE-2026-78322: File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.
Other sources
A stack-based buffer overflow exists in file-roller's parseprogressline() functions in the 7z and RAR archive backends (src/fr-command-7z.c and src/fr-command-rar.c). When processing output from the 7z or rar subprocess, file paths from archive entries are copied with strcpy() into fixed-size stack buffers (4196 and 4096 bytes) without length validation. An archive containing a file entry with a path longer than these buffers causes a stack buffer overflow when the user opens or extracts the archive in file-roller, resulting in denial of service (process termination). Practical code execution is considered difficult on hardened builds with stack canaries, PIE, and ASLR.
Reported upstream as https://gitlab.gnome.org/GNOME/file-roller/-/issues/327 by Yukihiro Nakamura. Fixed upstream in commit ffb76dc866342cef6a4914873faaa880d14d5aa4 ("Check line length when parsing command output"), first released in file-roller 44.7.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
file-rollerto a version that resolves this vulnerability.Fixed in 44.7Patch ffb76dc866342cef6a4914873faaa880d14d5aa4 - Compensating control
Mitigate by avoiding opening or extracting crafted 7z or RAR archives that contain excessively long file entry paths in file-roller.
Event History
Frequently Asked Questions
What user action is required for exploitation?
A victim must open or extract a crafted 7z or RAR archive with file-roller. The archive must contain a file entry with an excessively long path.
What is the practical impact of a successful exploit?
The overflow can cause file-roller to terminate, resulting in a denial of service. The provided information does not describe confidentiality or integrity impact.
Which archive formats and code paths are affected?
The issue affects file-roller's progress-line parsing for its 7z and RAR handlers. The vulnerable operation occurs while processing a malicious archive entry path during opening or extraction.