Is CVE-2026-4424 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4424 being exploited in the wild.

How severe is CVE-2026-4424?

High severity, with a CVSS score of 7.5, published 19 March 2026.

Which products and versions are affected?

libarchive libarchive All versions prior to fix; Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0, 10.0; Red Hat OpenShift Container Platform 4.16.

Is there a fix for CVE-2026-4424?

A patch was published on 2026-04-23: Red Hat released security updates (RHSA-2026:10065) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4424 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4424?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4424: libarchive heap out-of-bounds read in RAR processing

CVE-2026-4424 · Severity: high · CVSS 7.5 · Published 2026-03-19

A security vulnerability has been identified in libarchive, a widely used software library for reading and writing various archive formats like ZIP and RAR. This flaw allows an attacker to create a malicious RAR file that, when processed by the library, can expose sensitive information from the computer's memory. This could lead to the theft of data or help an attacker bypass other security measures, and it does not require any special user permissions or interaction to exploit.

Quick answers

Is CVE-2026-4424 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4424 being exploited in the wild.
How severe is CVE-2026-4424?: High severity, with a CVSS score of 7.5, published 19 March 2026.
Which products and versions are affected?: libarchive libarchive All versions prior to fix; Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0, 10.0; Red Hat OpenShift Container Platform 4.16.
Is there a fix for CVE-2026-4424?: A patch was published on 2026-04-23: Red Hat released security updates (RHSA-2026:10065) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4424 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4424?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap out-of-bounds read vulnerability exists in libarchive's RAR archive processing logic. The root cause is improper validation of the LZSS sliding window size when the decompressor transitions between different compression methods. A remote, unauthenticated attacker can exploit this by providing a specially crafted RAR archive. Successful exploitation allows the attacker to read sensitive information from heap memory, which could potentially be used to facilitate further attacks or leak sensitive data. The vulnerability is tracked as CWE-125. Patches have been released by various vendors, including Red Hat, and a pull request is available in the upstream libarchive repository.

Affected products

libarchive libarchive All versions prior to fix
Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0, 10.0
Red Hat OpenShift Container Platform 4.16

Timeline

2026-03-19: disclosed: Initial publication date
2026-04-23: patched: Red Hat released security updates (RHSA-2026:10065)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.