CVE-2026-4424 HIGH

CVE-2026-4424: Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Weakness CWE-125
Published March 19, 2026
Last update June 30, 2026

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

Key dates

02Disclosure timeline

March 19, 2026 CVE published
June 30, 2026 Record updated