VDB

GHSA-c75f-55f6-f63q

GHSA-c75f-55f6-f63q PUBLISHED CVSS 7.5 HIGH

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

Risk Scores

CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Timeline

  • Mar 19, 2026 CVE Published
  • Apr 10, 2026 Security Advisory
  • Apr 17, 2026 Distribution Patch
  • Apr 17, 2026 Distribution Patch
  • Apr 17, 2026 Distribution Patch
  • Apr 17, 2026 Distribution Patch
  • Apr 17, 2026 Distribution Patch
  • Apr 20, 2026 Distribution Patch
  • Apr 21, 2026 Distribution Patch
  • Apr 21, 2026 Distribution Patch
  • Apr 21, 2026 Distribution Patch
  • Apr 21, 2026 Distribution Patch

References

…and 9 more

Open in Interactive Console →
$ Console Community · 100/wk Open console ›