A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Libarchive |
|
| Redhat |
|
No data.
No data.
References
History
Thu, 23 Apr 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhui
|
|
| CPEs | cpe:/a:redhat:rhui:5::el9 | |
| Vendors & Products |
Redhat rhui
|
|
| References |
|
Wed, 22 Apr 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 22 Apr 2026 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat insights Proxy
|
|
| CPEs | cpe:/a:redhat:insights_proxy:1.5::el9 | |
| Vendors & Products |
Redhat insights Proxy
|
|
| References |
|
Wed, 22 Apr 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Eus Long Life
|
|
| CPEs | cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos |
|
| Vendors & Products |
Redhat rhel Eus Long Life
|
|
| References |
|
Mon, 20 Apr 2026 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos |
|
| References |
|
Mon, 20 Apr 2026 07:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/o:redhat:rhel_eus:9.6::baseos |
|
| References |
|
Mon, 20 Apr 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Tus
|
|
| CPEs | cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos |
|
| Vendors & Products |
Redhat rhel Tus
|
|
| References |
|
Mon, 20 Apr 2026 05:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Eus
|
|
| CPEs | cpe:/a:redhat:rhel_eus:9.4::appstream cpe:/a:redhat:rhel_eus:9.4::crb cpe:/o:redhat:rhel_eus:9.4::baseos |
|
| Vendors & Products |
Redhat rhel Eus
|
|
| References |
|
Mon, 20 Apr 2026 04:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat enterprise Linux Eus
|
|
| CPEs | cpe:/a:redhat:rhel_e4s:9.2::appstream cpe:/o:redhat:enterprise_linux_eus:10.0 cpe:/o:redhat:rhel_e4s:9.2::baseos |
|
| Vendors & Products |
Redhat enterprise Linux Eus
|
|
| References |
|
Mon, 20 Apr 2026 02:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel E4s
|
|
| CPEs | cpe:/a:redhat:rhel_e4s:9.0::appstream cpe:/o:redhat:rhel_e4s:9.0::baseos |
|
| Vendors & Products |
Redhat rhel E4s
|
|
| References |
|
Thu, 16 Apr 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Aus
Redhat rhel Els |
|
| CPEs | cpe:/o:redhat:rhel_aus:8.2::baseos cpe:/o:redhat:rhel_els:7 |
|
| Vendors & Products |
Redhat rhel Aus
Redhat rhel Els |
|
| References |
|
Thu, 16 Apr 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:enterprise_linux:8::crb cpe:/o:redhat:enterprise_linux:8::baseos |
|
| References |
|
Thu, 16 Apr 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos |
|
| References |
|
Thu, 16 Apr 2026 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/o:redhat:enterprise_linux:10.1 | |
| References |
|
Thu, 09 Apr 2026 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat hummingbird
|
|
| CPEs | cpe:/a:redhat:hummingbird:1 | |
| Vendors & Products |
Redhat hummingbird
|
Fri, 20 Mar 2026 09:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Libarchive
Libarchive libarchive Redhat openshift Container Platform |
|
| Vendors & Products |
Libarchive
Libarchive libarchive Redhat openshift Container Platform |
Fri, 20 Mar 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Thu, 19 Mar 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 19 Mar 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction. | |
| Title | Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing | |
| First Time appeared |
Redhat
Redhat enterprise Linux Redhat openshift |
|
| Weaknesses | CWE-125 | |
| CPEs | cpe:/a:redhat:openshift:4 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat enterprise Linux Redhat openshift |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2026-03-19T13:50:27.294Z
Updated: 2026-04-23T06:08:01.468Z
Reserved: 2026-03-19T12:23:38.191Z
Link: CVE-2026-4424
Vulnrichment
Updated: 2026-03-19T17:07:50.644Z
NVD
Status : Undergoing Analysis
Published: 2026-03-19T15:16:28.300
Modified: 2026-04-23T07:16:41.633
Link: CVE-2026-4424
Redhat