CVE-2026-4424

HIGH

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-4424 has a selected CVSS score of 7.5 (high).

Description

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 19, 2026 · Source: CVE List

Affected products and versions

Showing 12 of 51
ProductSourceVersion range

RHEL-8 based Middleware Containers

Browse Red Hat / RHEL-8 based Middleware Containersrhpam-7/rhpam-businesscentral-monitoring-rhel8

Default status: affected

CVE List7.13.5-4.1777325677 to < *unaffected

RHEL-8 based Middleware Containers

Browse Red Hat / RHEL-8 based Middleware Containersrhpam-7/rhpam-businesscentral-rhel8

Default status: affected

CVE List7.13.5-4.1777325711 to < *unaffected

RHEL-8 based Middleware Containers

Browse Red Hat / RHEL-8 based Middleware Containersrhpam-7/rhpam-controller-rhel8

Default status: affected

CVE List7.13.5-4.1777325710 to < *unaffected

RHEL-8 based Middleware Containers

Browse Red Hat / RHEL-8 based Middleware Containersrhpam-7/rhpam-dashbuilder-rhel8

Default status: affected

CVE List7.13.5-3.1777325680 to < *unaffected

RHEL-8 based Middleware Containers

Browse Red Hat / RHEL-8 based Middleware Containersrhpam-7/rhpam-kieserver-rhel8

Default status: affected

CVE List7.13.5-4.1777325709 to < *unaffected

RHEL-8 based Middleware Containers

Browse Red Hat / RHEL-8 based Middleware Containersrhpam-7/rhpam-process-migration-rhel8

Default status: affected

CVE List7.13.5-4.1777325680 to < *unaffected

RHEL-8 based Middleware Containers

Browse Red Hat / RHEL-8 based Middleware Containersrhpam-7/rhpam-smartrouter-rhel8

Default status: affected

CVE List7.13.5-4.1777325708 to < *unaffected

Red Hat AI Inference Server 3.2

Browse Red Hat / Red Hat AI Inference Server 3.2rhaiis/model-opt-cuda-rhel9

Default status: affected

CVE List1780681984 to < *unaffected

Red Hat AI Inference Server 3.2

Browse Red Hat / Red Hat AI Inference Server 3.2rhaiis/vllm-cuda-rhel9

Default status: affected

CVE List1779223654 to < *unaffected

Red Hat AI Inference Server 3.2

Browse Red Hat / Red Hat AI Inference Server 3.2rhaiis/vllm-rocm-rhel9

Default status: affected

CVE List1779223651 to < *unaffected

Red Hat AI Inference Server 3.3

Browse Red Hat / Red Hat AI Inference Server 3.3rhaiis/model-opt-cuda-rhel9

Default status: affected

CVE List1778244559 to < *unaffected

Red Hat AI Inference Server 3.3

Browse Red Hat / Red Hat AI Inference Server 3.3rhaiis/vllm-cuda-rhel9

Default status: affected

CVE List1778274666 to < *unaffected

References

Showing 12 of 39