Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious RAR archive
  2. Delivery
    Submit to target service
  3. Exploit
    Trigger libarchive extraction
  4. Execution
    Exploit LZSS window validation flaw
  5. Persist
    Read out-of-bounds heap memory
  6. Impact
    Exfiltrate sensitive data from response

Vulnerability Assessment

Weakness
CWE
CWE-125
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The target system must process attacker-supplied RAR archives using the vulnerable libarchive library. Exploitation specifically requires RAR files containing transitions between compression methods (e.g., switching from uncompressed to LZSS-compressed blocks within a single archive) with manipulated window size parameters. The vulnerability affects default libarchive configurations with RAR support enabled-no special features or non-default settings are required. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is needed; however, the attacker must have a pathway to deliver RAR archives to the target (file upload endpoint, email attachment processing, package repository ingestion, containerized application deployment). Systems that do not process RAR format or only handle archives from verified internal sources are not realistically exploitable despite meeting the technical prerequisites.
Impact

This vulnerability presents a confidentiality-only risk (CVSS C:H/I:N/A:N) with a straightforward attack profile: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). However, multiple risk indicators suggest lower real-world urgency than the 7.5 CVSS score implies. The EPSS score of 0.14% places this in the 35th percentile, indicating that statistical models predict low exploitation probability based on observable threat activity. No public exploit code has been identified, and the vulnerability is not present in CISA's Known Exploited Vulnerabilities catalog, confirming absence of confirmed active exploitation. The impact is limited to information disclosure from heap memory-while this could leak sensitive data like cryptographic keys or credentials, it does not enable direct code execution or system compromise. The SSVC framework would likely classify this as 'scheduled' priority: exploitation status is 'none', technical impact is 'partial' (confidentiality only), and automatable is 'yes' but requires the target to process attacker-controlled RAR archives. Organizations should prioritize patching systems that routinely process untrusted archives (email gateways, file upload services, automated extraction pipelines) over isolated systems.
Exploit ScenarioDerived

An attacker identifies a web application file upload service that uses libarchive for automatic archive extraction and content indexing. The attacker crafts a malicious RAR archive with deliberately malformed compression method transition markers that trigger improper LZSS window size validation. When the victim server's libarchive processes the upload, the vulnerability causes heap out-of-bounds reads, and the extracted 'file contents' returned to the attacker contain fragments of heap memory from the server process. This leaked memory could include session tokens, database credentials, or cryptographic keys from adjacent heap allocations, which the attacker uses for subsequent lateral movement attacks. No public exploit code exists, but the technical details in GitHub PR #2898 provide sufficient guidance for skilled attackers to develop working exploits.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv8 – Apr 22, 2026

Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.

Earlier versions of this analysis (7)
v7 Apr 20, 2026 - 14:30 cvss changed CVSS 7.5

Heap memory disclosure in libarchive's RAR decompression allows remote attackers to leak sensitive information by serving malicious archives. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. CVSS 7.5 (High) with unauthenticated network vector, but EPSS 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis, not listed in CISA KEV. Vendor patches released across multiple Red Hat advisories (RHSA-2026:8492 through RHSA-2026:8908), with upstream fix available via GitHub PR #2898.

v6 Apr 20, 2026 - 08:30 cvss changed CVSS 7.5

Heap out-of-bounds read in libarchive RAR decompression allows remote information disclosure via crafted archive files. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. Attack requires no authentication or user interaction - simply processing a malicious RAR file triggers the vulnerability. EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. Vendor patches available through multiple Red Hat security advisories (RHSA-2026:8492 and others). GitHub PR #2898 contains upstream fix.

v5 Apr 20, 2026 - 06:28 cvss changed CVSS 7.5

Heap out-of-bounds read in libarchive's RAR decompression engine allows remote unauthenticated attackers to disclose sensitive memory contents via malformed archives. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS exploitation probability is low (0.14%, 35th percentile) with no confirmed active exploitation or public POC, suggesting currently theoretical risk despite high CVSS 7.5. Vendor patches available through multiple Red Hat Security Advisories (RHSA-2026:8492 through RHSA-2026:8908). GitHub PR #2898 contains upstream fix.

v4 Apr 20, 2026 - 05:28 cvss changed CVSS 7.5

Heap out-of-bounds read in libarchive's RAR decompression engine allows remote unauthenticated attackers to leak sensitive heap memory via maliciously crafted RAR archives. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. Patch available from Red Hat (RHSA-2026:8492, 8510, 8517, 8521, 8534, 8864, 8865, 8867, 8873). No active exploitation confirmed (not in CISA KEV), but upstream fix exists (GitHub PR #2898). EPSS score 0.14% (35th percentile) suggests low immediate exploitation probability, though the network-accessible attack vector (AV:N) with no authentication (PR:N) or user interaction (UI:N) requirements warrants attention for systems parsing untrusted RAR archives.

v3 Apr 20, 2026 - 04:32 cvss changed CVSS 7.5

Heap out-of-bounds read in libarchive's RAR decompression exposes sensitive memory to remote unauthenticated attackers via malformed archives. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. Red Hat has released patches (RHSA-2026:8492 and related advisories). EPSS score of 0.14% (35th percentile) suggests low probability of widespread exploitation despite network accessibility, likely due to limited attacker value from information disclosure alone. No active exploitation confirmed; upstream fix merged in GitHub PR #2898.

v2 Apr 20, 2026 - 03:28 cvss changed CVSS 7.5

Heap memory disclosure in libarchive RAR decompression allows remote unauthenticated attackers to extract sensitive information by sending malformed RAR archives. The flaw affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. No authentication or user interaction required (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). Not actively exploited per CISA KEV; low EPSS score (0.14%, 35th percentile) suggests minimal observed exploitation activity. Vendor patches released via multiple Red Hat security advisories (RHSA-2026:8492, 8510, 8517, 8521, 8534, 8867). Upstream fix available in libarchive GitHub PR #2898.

v1 Mar 19, 2026 - 14:30 CVSS 7.5

A heap out-of-bounds read vulnerability exists in libarchive's RAR archive processing logic, caused by improper validation of the LZSS sliding window size during compression method transitions. This remotely exploitable flaw allows unauthenticated attackers to disclose sensitive heap memory contents by providing a specially crafted RAR archive without requiring user interaction. Red Hat Enterprise Linux versions 6 through 10 and Red Hat OpenShift Container Platform 4 are among the affected products, with a CVSS score of 7.5 reflecting high confidentiality impact.

RemediationAI

Apply the vendor-released patches immediately for systems processing untrusted archives. Red Hat Enterprise Linux users should install updates per the applicable RHSA advisory for their version (RHSA-2026:8492 for RHEL 6, RHSA-2026:8510 for RHEL 7, RHSA-2026:8534 for RHEL 8, RHSA-2026:8517 for RHEL 9, RHSA-2026:8521 for RHEL 10, and RHSA-2026:8908 for OpenShift 4), available at https://access.redhat.com/errata/. For upstream libarchive installations, upgrade to a version incorporating GitHub PR #2898. If immediate patching is not feasible, implement compensating controls: (1) restrict processing of RAR archives to trusted sources only by filtering file uploads and email attachments-this eliminates remote attack vectors but may disrupt legitimate workflows requiring RAR support; (2) run archive extraction in sandboxed environments with limited heap memory visibility (containers with memory constraints, SELinux confined processes) to reduce information leakage impact, though this does not prevent the vulnerability itself; (3) disable RAR format support in libarchive if the organization does not require it, though this requires recompilation with specific build flags. Monitor application logs for excessive archive processing errors that might indicate exploitation attempts.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects libarchive, a widely-used open-source library for reading and writing streaming archives in various formats (tar, cpio, zip, RAR, etc.). The flaw (CWE-125: Out-of-bounds Read) resides in the RAR decompression implementation, specifically in the LZSS (Lempel-Ziv-Storer-Szymanski) sliding window handling logic. LZSS is a dictionary-based compression algorithm that maintains a sliding window buffer for pattern matching. When processing RAR archives that transition between different compression methods, libarchive fails to properly validate and adjust the sliding window size, allowing reads beyond allocated heap boundaries. The affected CPE strings indicate this impacts Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10, plus Red Hat OpenShift Container Platform 4, all of which bundle libarchive as a core system library used by package managers, backup tools, and container runtimes. The upstream fix is tracked in GitHub pull request #2898.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

8
Analysis Updated
Apr 22, 2026 - 07:28 vuln.today
v8 - CVSS changed
Analysis Updated
Apr 20, 2026 - 14:30 vuln.today
v7 - CVSS changed
Analysis Updated
Apr 20, 2026 - 08:30 vuln.today
v6 - CVSS changed
Analysis Updated
Apr 20, 2026 - 06:28 vuln.today
v5 - CVSS changed
Analysis Updated
Apr 20, 2026 - 05:28 vuln.today
v4 - CVSS changed
Analysis Updated
Apr 20, 2026 - 04:32 vuln.today
v3 - CVSS changed
Analysis Updated
Apr 20, 2026 - 03:28 vuln.today
v2 - CVSS changed
CVE Published
Mar 19, 2026 - 13:50 nvd
HIGH 7.5

DescriptionCVE.org

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

Executive ViewAI

Why It Matters

CVE-2026-4424 is a heap memory disclosure vulnerability in libarchive affecting Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, allowing unauthenticated remote attackers to read sensitive data via malformed RAR archives. While the vulnerability carries a HIGH CVSS score and network-exploitable attack surface, the 0.1% EPSS score and absence of public exploit code indicate low current exploitation risk, positioning this as a standard patch-cycle priority rather than emergency remediation.

Business Impact: Medium
Compensating Controls

Apply vendor patch. Interim mitigations pending patch deployment: restrict RAR archive processing to trusted internal sources only; implement network segmentation to limit exposure of systems processing archive files; disable RAR archive support in libarchive configurations where functionality is not required; monitor heap memory access patterns for anomalous data exfiltration attempts.

Threat Intelligence Overview

EPSS Score
0.1%
Top 65% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8292-1 ADVISORY https://vuldb.com/?id.351709 REF https://access.redhat.com/errata/RHSA-2026:10065 REF https://access.redhat.com/errata/RHSA-2026:10097 REF https://access.redhat.com/errata/RHSA-2026:11768 REF https://access.redhat.com/errata/RHSA-2026:12071 REF https://access.redhat.com/errata/RHSA-2026:12274 REF https://access.redhat.com/errata/RHSA-2026:13812 REF https://access.redhat.com/errata/RHSA-2026:14773 REF https://access.redhat.com/errata/RHSA-2026:14937 REF https://access.redhat.com/errata/RHSA-2026:15087 REF https://access.redhat.com/errata/RHSA-2026:16008 REF https://access.redhat.com/errata/RHSA-2026:16009 REF https://access.redhat.com/errata/RHSA-2026:16030 REF https://access.redhat.com/errata/RHSA-2026:16174 REF https://access.redhat.com/errata/RHSA-2026:17596 REF https://access.redhat.com/errata/RHSA-2026:19724 REF https://access.redhat.com/errata/RHSA-2026:19725 REF https://access.redhat.com/errata/RHSA-2026:20040 REF https://access.redhat.com/errata/RHSA-2026:21690 REF https://access.redhat.com/errata/RHSA-2026:25096 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/errata/RHSA-2026:8492 REF https://access.redhat.com/errata/RHSA-2026:8510 REF https://access.redhat.com/errata/RHSA-2026:8517 REF https://access.redhat.com/errata/RHSA-2026:8521 REF https://access.redhat.com/errata/RHSA-2026:8534 REF https://access.redhat.com/errata/RHSA-2026:8864 REF https://access.redhat.com/errata/RHSA-2026:8865 REF https://access.redhat.com/errata/RHSA-2026:8866 REF https://access.redhat.com/errata/RHSA-2026:8867 REF https://access.redhat.com/errata/RHSA-2026:8873 REF https://access.redhat.com/errata/RHSA-2026:8908 REF https://access.redhat.com/errata/RHSA-2026:8944 REF https://access.redhat.com/errata/RHSA-2026:9026 REF https://access.redhat.com/errata/RHSA-2026:9592 REF https://access.redhat.com/errata/RHSA-2026:9832 REF https://access.redhat.com/security/cve/CVE-2026-4424 REF https://bugzilla.redhat.com/show_bug.cgi?id=2449006 REF https://github.com/libarchive/libarchive/pull/2898 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4424.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy