Junrar EUVD-2026-102251

Exploitation requires an application using junrar prior to 7.6.1 to parse an attacker-supplied RAR4 archive, where the archive embeds a RAR virtual-machine program containing a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The RAR4 VM code path (not RAR5) must be reachable, meaning the host application must feed untrusted archives through junrar's extraction/VM processing. No authentication or user interaction is required per CVSS (PR:N/UI:N) when the archive is processed server-side automatically; the practical limiting factor is that the target must actually process untrusted RAR4 content through junrar, and impact is confined to CPU/thread exhaustion (availability) with no data exposure or code execution.

This is a genuine but bounded availability risk, not a critical priority. The CVSS 7.5 is driven entirely by the availability impact (A:H) with a clean network-reachable, unauthenticated, low-complexity vector (AV:N/AC:L/PR:N/UI:N) and no confidentiality or integrity impact (C:N/I:N) - consistent with CWE-835 (infinite loop). No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from the data; based on available signals this is 'no public exploit identified at time of analysis.' The one clear conflict is the input 'RCE' tag, which directly contradicts the vendor description: the advisory explicitly states the RAR VM does not expose native process execution and that impact is availability loss only - treat the RCE tag as erroneous. Net: a real, easy-to-trigger DoS against services that process untrusted RAR archives with junrar, but it does not enable code execution and lacks confirmed in-the-wild exploitation, so it warrants patching rather than emergency response.

An application (e.g., a file-processing or antivirus/indexing service such as those embedding junrar via Apache Tika) accepts user-uploaded RAR archives and extracts them with junrar prior to 7.6.1. An attacker submits a crafted RAR4 archive whose embedded RAR VM program contains a VM_JMP instruction targeting an offset at or beyond codeSize; the extraction worker thread spins indefinitely at 100% CPU. No public exploit code was identified in the provided data, but the condition is trivially constructible given the described flaw.