# CVE-2017-5601: libarchive out-of-bounds read in lha_read_file_header_1

Source: https://junglewise.ai/threats/cve-2017-5601-libarchive-out-of-bounds-read-in-lha-read-file-header-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-27. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5601 · Severity: high · CVSS 7.5 · Published 2017-01-27

A vulnerability in libarchive, a widely used library for reading and writing various archive formats, could allow an attacker to crash applications that process compressed files. By providing a specially crafted LHA archive, an attacker can trigger a memory error that leads to a denial-of-service. This affects any software relying on libarchive to handle file extractions, potentially disrupting automated workflows or server operations.

Technologies: [Libarchive](https://junglewise.ai/threats/technologies/libarchive). Vendors: [Libarchive](https://junglewise.ai/threats/vendors/libarchive).

## Quick answers

**Is CVE-2017-5601 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5601 being exploited in the wild.

**How severe is CVE-2017-5601?** High severity, with a CVSS score of 7.5, published 27 January 2017.

**Which products and versions are affected?** libarchive libarchive 3.2.2.

**Is there a fix for CVE-2017-5601?** A patch was published on 2018-11-29: Debian LTS security update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5601 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2017-5601?** Check whether you run Libarchive. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in the lha_read_file_header_1() function within archive_read_support_format_lha.c of libarchive 3.2.2. The issue stems from improper validation of the compressed size (compsize) field in LHA headers; specifically, the code fails to account for cases where the calculated compressed size becomes negative after subtracting extended header sizes. An attacker can exploit this by providing a malformed LHA archive, leading to an out-of-bounds memory access and a subsequent heap buffer overflow or crash. A patch was released to ensure the compressed size is validated as non-negative before proceeding.

## Affected products

- libarchive libarchive 3.2.2

## Timeline

- 2017-01-27: advisory: NVD publication date
- 2017-01-27: disclosed: Initial public disclosure
- 2018-11-29: patched: Debian LTS security update released

## References

- [http://www.securityfocus.com/bid/95837](http://www.securityfocus.com/bid/95837)
- [http://www.securitytracker.com/id/1037974](http://www.securitytracker.com/id/1037974)
- [https://github.com/libarchive/libarchive/commit/98dcbbf0bf4854bf987557e55e55fff7abbf3ea9](https://github.com/libarchive/libarchive/commit/98dcbbf0bf4854bf987557e55e55fff7abbf3ea9)
- [https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html](https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html)
- [https://secunia.com/secunia_research/2017-3/](https://secunia.com/secunia_research/2017-3/)

## Related threats

- [Windows Libarchive double free vulnerability](https://junglewise.ai/threats/cve-2026-70062-double-free-in-windows-libarchive-allows-an-unauthorized-attacker)
- [Windows Libarchive path traversal vulnerability](https://junglewise.ai/threats/cve-2026-69973-improper-limitation-of-a-pathname-to-a-restricted-directory-path)
- [Libarchive relative path traversal in Windows](https://junglewise.ai/threats/cve-2026-69968-relative-path-traversal-in-windows-libarchive-allows-an)
- [libarchive gzip writer heap buffer overflow in original-filename](https://junglewise.ai/threats/cve-2025-64031-libarchive-gzip-writer-heap-buffer-overflow-in-original-filename)
- [libarchive heap overflow in PAX SUN.holesdata parsing](https://junglewise.ai/threats/cve-2026-15028-libarchive-heap-overflow-in-pax-sun-holesdata-parsing)