AZL-80403 CVE-2026-4424 affecting package libarchive for versions less than 3.7.7-6

🗓️ 19 Mar 2026 15:16:28Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Heap OOB read in libarchive RAR processing via LZSS window enabling info disclosure.

Reporter	Title	Published	Views	Family All 190
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues	18 Jun 202619:59	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for August 2026.	1 Sep 202615:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues	10 Jun 202618:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities	20 May 202615:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	25 May 202613:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	1 Jun 202609:28	–	ibm
ATTACKERKB	CVE-2026-4424	19 Mar 202613:50	–	attackerkb
Tenable Nessus	AlmaLinux 10 : libarchive (ALSA-2026:8492)	21 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : libarchive (ALSA-2026:8510)	17 Apr 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : libarchive (ALSA-2026:8534)	20 Apr 202600:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-4424

01 Sep 2026 05:28Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5

EPSS0.01237

SSVC

libarchive heap out-of-bounds read RAR processing LZSS sliding window info disclosure unauthenticated