CVE-2026-16517: libarchive signed integer overflow in ZIP writer

CVE-2026-16517 · Severity: low · CVSS 2.9 · Published 2026-07-21

libarchive is a widely used library for reading and writing various archive formats like ZIP and TAR. A flaw in its ZIP writing component could cause the software to behave unpredictably or crash when processing extremely large encrypted files. Because this requires creating a file of nearly 9 quintillion bytes, the practical risk to most business operations is very low.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4. Vendors: Red Hat.

Quick answers

Is CVE-2026-16517 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-16517 being exploited in the wild.
How severe is CVE-2026-16517?
Low severity, with a CVSS score of 2.9, published 21 July 2026.
Which products and versions are affected?
Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 6 affected; Red Hat Enterprise Linux 7 affected; Red Hat Enterprise Linux 8 affected; and 2 more.
Is there a fix for CVE-2026-16517?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16517 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-16517?
Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A signed integer overflow vulnerability exists in libarchive's ZIP writer within the `archive_write_zip_header` function in `archive_write_set_format_zip.c`. The flaw is triggered when ZIP encryption (such as AES-256) is enabled and a file entry size is near `INT64_MAX`. Adding the encryption overhead to the uncompressed entry size causes an overflow of the `int64_t` variable, leading to undefined behavior. This can result in incorrect Zip64 extension logic or potential memory corruption. Exploitation is considered unlikely as it requires the write path to handle a file size approaching the theoretical limit of a 64-bit signed integer. An upstream fix has been identified in pull request 3228.

Affected products

  • libarchive libarchive unspecified
  • Red Hat Red Hat Enterprise Linux 6 affected
  • Red Hat Red Hat Enterprise Linux 7 affected
  • Red Hat Red Hat Enterprise Linux 8 affected
  • Red Hat Red Hat Enterprise Linux 9 affected
  • Red Hat Red Hat Enterprise Linux 10 affected
  • Red Hat Red Hat OpenShift Container Platform 4 affected

Timeline

  • 2026-07-21: disclosed: Vulnerability reported and CVE assigned.
  • 2026-07-21: advisory: Red Hat published security advisory.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.