High · published March 19, 2026
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.
| Product | Versions | Fixed in |
|---|---|---|
| libarchive/libarchive | all versions | — |
| redhat/hardened_images | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/openshift_container_platform_for_arm64 | all versions | — |
| redhat/openshift_container_platform_for_power | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |