rardecode CVE-2025-11579

Exploitation requires that a target application built on nwaples/rardecode <=2.1.1 actually opens/decodes an attacker-supplied RAR archive - the condition is processing untrusted RAR input, which maps to the CVSS UI:R requirement. The specific trigger is a RAR file whose declared dictionary (window) size exceeds the library's internal maxDictSize, which prior to the fix was not bounded against a configurable per-call limit. Limiting factors: the attacker cannot force exploitation without the application consuming the malicious file (no server-initiated path), there is no authentication or privilege needed on the attacker side (PR:N), and impact is restricted to availability (process OOM crash) - no confidentiality or integrity effect. Deployments that never ingest externally-controlled RAR archives are effectively unaffected.

This is a genuine but moderate-severity availability issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5 MEDIUM) is internally consistent with the description and CWE-789 (memory allocation with excessive size value): an unauthenticated attacker can remotely supply a crafted RAR file, but exploitation requires the victim application/user to actually parse it (UI:R), and impact is confined to availability (C:N/I:N - no data exposure or code execution). All exploitation signals point the same low-urgency direction: EPSS is only 0.37% (29th percentile), there is NO CISA KEV listing, and NO public proof-of-concept is referenced - so no public exploit is identified at time of analysis. No SSVC decision data was provided in the input. The one strong mitigating reality is that the impact ceiling is an out-of-memory crash of the parsing process, not system compromise; for most consumers the realistic worst case is a restartable service crash. Priority should therefore be routine patching, elevated only for services that ingest attacker-controlled RAR archives in long-lived or single-process-critical contexts.

An attacker crafts a RAR archive whose header declares an enormous dictionary (window) size and delivers it to a Go service that uses nwaples/rardecode <=2.1.1 to extract uploads (e.g., a file-sharing or attachment-processing backend such as the one operated by the reporting party, Mattermost). When the application opens the archive, rardecode attempts to honor the unvalidated dictionary size and allocates excessive memory, crashing the process via OOM. No public exploit code is referenced, but the malicious-input construction is straightforward given the described missing bounds check.