ANCHORE-2026-4424

ANCHORE-2026-4424 PUBLISHED

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

Affected Products

Vendor	Product	Versions
libarchive	libarchive	0, 0

Timeline

Mar 19, 2026 CVE Published
Apr 30, 2026 CVE Updated
May 2, 2026 Distribution Patch
May 2, 2026 Distribution Patch
May 2, 2026 Distribution Patch
May 2, 2026 Distribution Patch
May 2, 2026 Distribution Patch
May 2, 2026 Distribution Patch
May 2, 2026 Distribution Patch
May 2, 2026 Distribution Patch
May 2, 2026 Distribution Patch
May 2, 2026 Distribution Patch

References

https://access.redhat.com/errata/RHSA-2026:10065 url
https://access.redhat.com/errata/RHSA-2026:10097 url
https://access.redhat.com/errata/RHSA-2026:11768 url
https://access.redhat.com/errata/RHSA-2026:8492 url
https://access.redhat.com/errata/RHSA-2026:8510 url
https://access.redhat.com/errata/RHSA-2026:8517 url
https://access.redhat.com/errata/RHSA-2026:8521 url
https://access.redhat.com/errata/RHSA-2026:8534 url
https://access.redhat.com/errata/RHSA-2026:8864 url
https://access.redhat.com/errata/RHSA-2026:8865 url
https://access.redhat.com/errata/RHSA-2026:8866 url
https://access.redhat.com/errata/RHSA-2026:8867 url
https://access.redhat.com/errata/RHSA-2026:8873 url
https://access.redhat.com/errata/RHSA-2026:8908 url
https://access.redhat.com/errata/RHSA-2026:8944 url
https://access.redhat.com/errata/RHSA-2026:9026 url
https://access.redhat.com/errata/RHSA-2026:9592 url
https://access.redhat.com/errata/RHSA-2026:9832 url
https://access.redhat.com/security/cve/CVE-2026-4424 url
https://bugzilla.redhat.com/show_bug.cgi?id=2449006 url

…and 1 more

Open in Interactive Console →