Executive brief
libarchive is a widely used library for reading and writing various archive formats like ZIP and TAR. A flaw in its ZIP writing component could cause the software to behave unpredictably or crash when processing extremely large encrypted files. Because this requires creating a file of nearly 9 quintillion bytes, the practical risk to most business operations is very low.
Technical details
A signed integer overflow vulnerability exists in libarchive's ZIP writer within the `archive_write_zip_header` function in `archive_write_set_format_zip.c`. The flaw is triggered when ZIP encryption (such as AES-256) is enabled and a file entry size is near `INT64_MAX`. Adding the encryption overhead to the uncompressed entry size causes an overflow of the `int64_t` variable, leading to undefined behavior. This can result in incorrect Zip64 extension logic or potential memory corruption. Exploitation is considered unlikely as it requires the write path to handle a file size approaching the theoretical limit of a 64-bit signed integer. An upstream fix has been identified in pull request 3228.
Affected products
- libarchive libarchive unspecified
- Red Hat Red Hat Enterprise Linux 6 affected
- Red Hat Red Hat Enterprise Linux 7 affected
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat OpenShift Container Platform 4 affected
Timeline
- 2026-07-21: disclosed: Vulnerability reported and CVE assigned.
- 2026-07-21: advisory: Red Hat published security advisory.