Is CVE-2026-4111 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4111 being exploited in the wild.

How severe is CVE-2026-4111?

High severity, with a CVSS score of 7.5, published 13 March 2026.

Which products and versions are affected?

Libarchive All versions prior to the fix in pull request 2877; Red Hat Update Infrastructure 5.1.

Is there a fix for CVE-2026-4111?

A patch was published on 2026-04-23: Red Hat released security updates for RHUI 5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4111 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4111?

Check whether you run Libarchive or Red Hat Update Infrastructure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4111: libarchive infinite loop in RAR5 decompression

CVE-2026-4111 · Severity: high · CVSS 7.5 · Published 2026-03-13

A flaw was found in libarchive, a widely used software library for reading and writing various compressed file formats. When the library attempts to process a specially crafted RAR5 archive, it can enter an infinite loop that consumes all available processor power. This can be used by attackers to crash or freeze services that automatically scan or process uploaded files, leading to a total service outage.

Technologies: Libarchive. Vendors: Libarchive, Red Hat.

Quick answers

Is CVE-2026-4111 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4111 being exploited in the wild.
How severe is CVE-2026-4111?: High severity, with a CVSS score of 7.5, published 13 March 2026.
Which products and versions are affected?: Libarchive All versions prior to the fix in pull request 2877; Red Hat Update Infrastructure 5.1.
Is there a fix for CVE-2026-4111?: A patch was published on 2026-04-23: Red Hat released security updates for RHUI 5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4111 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4111?: Check whether you run Libarchive or Red Hat Update Infrastructure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the RAR5 decompression logic of libarchive within the archive_read_data() processing path. The flaw is categorized as CWE-835 (Loop with Unreachable Exit Condition). When a specially crafted RAR5 archive is processed, the internal state machine fails to progress, resulting in an infinite loop that exhausts CPU resources. The attack is particularly effective because the malicious archive can pass initial checksum and structural validations, preventing detection by applications before the decompression routine is invoked. A fix has been identified in libarchive pull request 2877, and Red Hat has issued multiple advisories (e.g., RHSA-2026:10065, RHSA-2026:10081) for affected products.

Affected products

libarchive libarchive All versions prior to the fix in pull request 2877
Red Hat OpenShift Container Platform 4.16, 4.19
Red Hat Update Infrastructure 5.1

Timeline

2026-03-13: disclosed: Initial publication date
2026-03-13: advisory: NVD record created
2026-04-23: patched: Red Hat released security updates for RHUI 5.1
2026-04-29: patched: Red Hat released security updates for OpenShift 4.19.29

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.