CVE-2026-78322: Buffer Copy without Checking Size of Input

A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer...

libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filteredbuf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of...

libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filteredbuf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of...

ALSA-2026:52674 Moderate: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...

Moderate: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...

JLSEC-2026-1169 7-Zip for Windows fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched...

SUSE-SU-2026:3429-1 Security update for libarchive

This update for libarchive fixes the following issues: - creating temporary files in the current working directory instead of the target directory can lead to file creation failures when the working directory is not writable bsc1254340. - file descriptor leak in the mtree parser cleanup path coul...

Exploit for Heap-based Buffer Overflow in Libarchive

CVE-2025-5915 — libarchive RAR v4 heap over-read with on-devi...

org.apache.activemq:activemq-osgi (>=6.0.0, <=6.2.7), org.apache.activemq:activemq-rar (>=6.0.0, <=6.2.7) +1 more potentially affected by CVE-2026-59878 via org.apache.activemq:activemq-amqp (>=6.0.0, <=6.2.7)

org.apache.activemq:activemq-amqp MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.7 Source cves: CVE-2026-59878 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-19351886...

org.apache.activemq:activemq-osgi (>=6.0.0, <=6.2.7), org.apache.activemq:activemq-rar (>=6.0.0, <=6.2.7) +1 more potentially affected by CVE-2026-61487 via org.apache.activemq:activemq-amqp (>=6.0.0, <=6.2.7)

org.apache.activemq:activemq-amqp MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.7 Source cves: CVE-2026-61487 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-19352102...

org.apache.activemq:activemq-osgi (>=6.0.0, <=6.2.7), org.apache.activemq:activemq-rar (>=6.0.0, <=6.2.7) +1 more potentially affected by CVE-2026-59878 via org.apache.activemq:activemq-amqp (>=6.0.0, <=6.2.7)

org.apache.activemq:activemq-amqp MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.7 Source cves: CVE-2026-59878 Source advisory: MEND:CVE-2026-59878...

macOS 26.x < 26.6 Multiple Vulnerabilities (128067)

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.6. It is, therefore, affected by multiple vulnerabilities: - A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of Safe Browsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control through a crafted RAR file. Chromium security severity: Medium...

USN-8581-1: libarchive vulnerabilities

It was discovered that libarchive did not properly manage memory when unpacking certain RAR5 archives, leading to a double free. An attacker could possibly use this issue to cause a denial of service. CVE-2026-14164 It was discovered that libarchive did not properly validate certain tar archives,...

USN-8581-1 libarchive vulnerabilities

It was discovered that libarchive did not properly manage memory when unpacking certain RAR5 archives, leading to a double free. An attacker could possibly use this issue to cause a denial of service. CVE-2026-14164 It was discovered that libarchive did not properly validate certain tar archives,...

OESA-2026-2890 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

Libarchive security update (CVE-2026-5121, CVE-2026-4424)

CVE-2026-5121 - Title: Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing Description A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can...

SUSE SLES12 Security Update : libarchive (SUSE-SU-2026:2747-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2747-1 advisory. This update for libarchive fixes the following issues - CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches bsc1253088. -...

SUSE-SU-2026:2747-1 Security update for libarchive

This update for libarchive fixes the following issues - CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches bsc1253088. - CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing bsc1259928. - CVE-2026-4426: undefined behavior due to unvalidat...

CVE-2026-14191

An out-of-bounds heap write exists in the RAR5 recovery-volume .rev parser in WinRAR and UnRAR RecVolumes5::ReadHeader in recvol5.cpp. The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated again...