file-roller EUVD-2026-65311

Exploitation requires that the victim actively open or extract a crafted archive using file-roller specifically - the vulnerable code path is in the progress-line parsing routine triggered during 7z and RAR archive operations (other formats are not identified as affected). No authentication, no network-exposed service, and no elevated privileges are needed, but the attack is entirely gated on social engineering: the attacker must deliver the malicious archive file to the victim and induce them to open it with file-roller rather than another tool. Limiting factors include: requirement for active user interaction (UI:R), restriction to 7z and RAR formats specifically, dependency on the victim using file-roller (not an alternative archive manager), and impact ceiling of an application crash with no code execution or data access consequence.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) correctly captures the low attack complexity and absence of privilege requirements, but the mandatory user interaction (UI:R) and availability-only impact materially constrain real-world risk. The attack surface is limited to desktop GNOME environments where end users open untrusted archives; file-roller is not a network service, so no remote unauthenticated exploitation of listening ports is possible. EPSS data was not provided, precluding a probability-of-exploitation comparison. Neither KEV listing nor public exploit code has been identified, which together suggest no current widespread opportunistic exploitation. The impact ceiling is an application crash - no privilege escalation, no data exfiltration, and no persistent compromise - making this a routine desktop patching priority rather than an emergency response scenario. The CVSS network vector (AV:N) reflects attacker-controlled file delivery over the network rather than a network-exposed service, a nuance worth noting when triaging against infrastructure-level vulnerabilities of similar score.

An attacker crafts a 7z or RAR archive containing a file entry whose embedded path exceeds the fixed-size stack buffer in file-roller's progress-line parser, then distributes it via phishing email, a malicious download link, or a file-sharing service. When the victim saves and opens the archive using file-roller on a GNOME desktop, the unbounded string copy operation overflows the stack buffer and crashes the application. No public exploit code has been identified at time of analysis, though the vulnerability is mechanically straightforward given the upstream bug report and fix commit.