A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.
CVE-2026-4424
CVSS base score
7.5 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-125
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
libarchive libarchive
redhat hardened images
redhat openshift container platform
redhat openshift container platform for arm64
redhat openshift container platform for power
redhat enterprise linux
redhat enterprise linux server aus
References
- access.redhat.com Third Party Advisory
- access.redhat.com Third Party Advisory
- access.redhat.com Third Party Advisory
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com