CVE-2026-4424

HIGH

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

Title source: cna

Description

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

References (37)

Core 37

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:21690

https://access.redhat.com/errata/RHSA-2026:21690

https://github.com/libarchive/libarchive/pull/2898

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8492

https://access.redhat.com/errata/RHSA-2026:8492

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:25096

https://access.redhat.com/errata/RHSA-2026:25096

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:10097

https://access.redhat.com/errata/RHSA-2026:10097

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:9832

https://access.redhat.com/errata/RHSA-2026:9832

Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2026-4424

Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat

RHBZ#2449006

https://bugzilla.redhat.com/show_bug.cgi?id=2449006

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:10065

https://access.redhat.com/errata/RHSA-2026:10065

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:13812

https://access.redhat.com/errata/RHSA-2026:13812

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:14937

https://access.redhat.com/errata/RHSA-2026:14937

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8517

https://access.redhat.com/errata/RHSA-2026:8517

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8521

https://access.redhat.com/errata/RHSA-2026:8521

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8534

https://access.redhat.com/errata/RHSA-2026:8534

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8864

https://access.redhat.com/errata/RHSA-2026:8864

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8865

https://access.redhat.com/errata/RHSA-2026:8865

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8866

https://access.redhat.com/errata/RHSA-2026:8866

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8867

https://access.redhat.com/errata/RHSA-2026:8867

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:12274

https://access.redhat.com/errata/RHSA-2026:12274

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8873

https://access.redhat.com/errata/RHSA-2026:8873

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8908

https://access.redhat.com/errata/RHSA-2026:8908

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8944

https://access.redhat.com/errata/RHSA-2026:8944

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:12071

https://access.redhat.com/errata/RHSA-2026:12071

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:9026

https://access.redhat.com/errata/RHSA-2026:9026

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:9592

https://access.redhat.com/errata/RHSA-2026:9592

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:11768

https://access.redhat.com/errata/RHSA-2026:11768

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:14773

https://access.redhat.com/errata/RHSA-2026:14773

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:15087

https://access.redhat.com/errata/RHSA-2026:15087

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:16008

https://access.redhat.com/errata/RHSA-2026:16008

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:16009

https://access.redhat.com/errata/RHSA-2026:16009

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:16030

https://access.redhat.com/errata/RHSA-2026:16030

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:16174

https://access.redhat.com/errata/RHSA-2026:16174

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8510

https://access.redhat.com/errata/RHSA-2026:8510

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:17596

https://access.redhat.com/errata/RHSA-2026:17596

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:19724

https://access.redhat.com/errata/RHSA-2026:19724

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:19725

https://access.redhat.com/errata/RHSA-2026:19725

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:20040

https://access.redhat.com/errata/RHSA-2026:20040

Scores

CVSS v3 7.5

EPSS 0.0088

EPSS Percentile 54.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-125

Status published

Products (50)

libarchive/libarchive

Red Hat/Red Hat AI Inference Server 3.2 1779223651

Red Hat/Red Hat AI Inference Server 3.2 1779223654

Red Hat/Red Hat AI Inference Server 3.2 1780681984

Red Hat/Red Hat AI Inference Server 3.3 1778244531

Red Hat/Red Hat AI Inference Server 3.3 1778244546

Red Hat/Red Hat AI Inference Server 3.3 1778244559

Red Hat/Red Hat AI Inference Server 3.3 1778274666

Red Hat/Red Hat Discovery 2 1778101579

Red Hat/Red Hat Discovery 2 1778156756

... and 40 more

Published Mar 19, 2026

Tracked Since Mar 19, 2026