Executive brief
file-roller is a file archive manager commonly used in GNOME desktop environments to open and extract compressed archives. A flaw in its progress-line parsing allows a malicious 7z or RAR archive with an extremely long file path to trigger a stack buffer overflow, causing the application to crash and denying users access to their files. An attacker must trick a user into opening a crafted archive for exploitation.
Technical details
The vulnerability is a classic stack buffer overflow (CWE-120) in file-roller's progress-line parsing code for 7z and RAR archive handlers. When processing an archive entry with an excessively long file path, the application copies the path into a fixed-size stack buffer using unbounded string copy, without validating the input length. The attack vector is network-based with user interaction required (victim must open or extract the malicious archive). Successful exploitation causes denial of service by crashing the application; arbitrary code execution is unlikely on hardened systems. Upstream patch is available (GitLab commit ffb76dc8).
Affected products
- GNOME file-roller <unknown
Timeline
- 2026-08-25: disclosed
- other: Upstream patch available at GitLab commit ffb76dc8