CVE-2024-26256

A flaw was found in the libarchive library. A heap-based buffer overflow in the execute_filter_e8 function in the libarchive/archive_read_support_format_rar.c file can be triggered when a specially crafted RAR archive is processed, causing a crash to the application linked to the library, and resulting in a denial of service.

The remote code execution is only mentioned in Windows context without any evidence or PoC. As this issue is only a small buffer over-read, without impact to integrity or confidentiality, this flaw was rated as causing only a denial of service to the application linked to the libarchive library.

Additionally, libarchive as shipped in Red Hat Enterprise Linux 6, 7, 8 and 9, is not affected by this vulnerability because the vulnerable code was introduced in a newer version of libarchive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.