CVE-2026-78322

A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.

This flaw in file-roller can lead to a denial of service when processing specially crafted 7z or RAR archives. The vulnerability, a stack buffer overflow, occurs when file paths from archive entries exceed fixed-size buffers during progress line parsing, causing the application to terminate. Exploitation requires user interaction and is difficult for arbitrary code execution on hardened Red Hat systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid opening or extracting untrusted 7z or RAR archives with file-roller until an updated package is installed.