EUVD-2026-47586
GHSA-j8w5-8rj6-wpwf
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Local vector and high complexity from dual prerequisite (encryption + near-INT64_MAX size); I:L added because incorrect Zip64 decisions corrupt archive structural integrity.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.
AnalysisAI
Signed integer overflow in libarchive's ZIP writer (archive_write_zip_header in archive_write_set_format_zip.c) produces undefined behavior when ZIP encryption is enabled and a file entry size approaches INT64_MAX, causing the encryption overhead addition to wrap the int64_t type. The resulting undefined behavior may cause incorrect Zip64 extension logic - producing malformed archive structure - or, in worst-case scenarios, memory corruption that could affect availability of the consuming process. No public exploit or active exploitation has been identified; the CVSS score of 2.9 and high attack complexity reflect extreme trigger conditions that are practically unreachable in normal deployments.
Technical ContextAI
libarchive is a portable C library for reading and writing archive formats including tar, zip, cpio, and others, and is deeply embedded in Linux distributions, macOS, and numerous open-source toolchains. The vulnerable code path is in the ZIP writer module (archive_write_set_format_zip.c), specifically in archive_write_zip_header. CWE-190 (Integer Overflow or Wraparound) is the root cause: the C standard defines signed integer overflow as undefined behavior, so when encryption overhead bytes are added to an int64_t entry size that is already near INT64_MAX (approximately 9.2 × 10^18), the result wraps or produces an indeterminate value. The Zip64 extension in the ZIP specification is required for files exceeding 4 GB; if the size calculation is corrupted, the writer may incorrectly decide whether to emit Zip64 extra fields, producing a structurally invalid archive or corrupting adjacent heap metadata.
Affected ProductsAI
libarchive (ZIP writer component, function archive_write_zip_header in archive_write_set_format_zip.c) is affected. The exact range of vulnerable versions is not specified in the available data; affected versions should be confirmed via the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-16517 and the Red Hat Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2505492. No CPE strings were provided in the source data, so version ranges must be independently verified from vendor sources. The vulnerability was reported by Red Hat Product Security (secalert@redhat.com), suggesting Red Hat Enterprise Linux and derivative distributions that package libarchive are within scope.
RemediationAI
No specific patched version number is confirmed in the available data. Monitor the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-16517 and Bugzilla ticket #2505492 at https://bugzilla.redhat.com/show_bug.cgi?id=2505492 for patch availability and exact fix versions; apply the vendor-released update as soon as it is published. As a compensating control where patching is delayed, avoid invoking libarchive's ZIP writer with encryption enabled on file entries whose sizes are provided by untrusted external sources without bounding or validating the size values before passing them to the API. In practice, file sizes near INT64_MAX are physically impossible in most deployments, so the real-world exposure window is minimal; nonetheless, input validation on entry sizes is a sound defensive measure with no meaningful operational trade-off.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today