CVE catalog
CVE-2026-4111
libarchive vulnerabilities
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.70% · Oct 25, 2026
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libarchive | sid | 3.8.10-2 | fixed |
| Debian | libarchive | forky | 3.8.9-1 | fixed |
| Debian | libarchive | trixie | 3.7.4-4+deb13u1 | fixed |
| Debian | libarchive | bookworm | 3.6.2-1+deb12u4 | fixed |
| Debian | libarchive | bookworm-security | 3.6.2-1+deb12u5 | fixed |
| Ubuntu | libarchive | noble | 3.6.2-1+deb12u4 | fixed |
| Ubuntu | libarchive | noble | 3.7.2-2ubuntu0.6 | fixed |
| Ubuntu | libarchive-dev | noble | 3.7.2-2ubuntu0.6 | fixed |
| Ubuntu | libarchive-tools | noble | 3.7.2-2ubuntu0.6 | fixed |
| Ubuntu | libarchive13t64 | noble | 3.7.2-2ubuntu0.6 | fixed |
| Ubuntu | libarchive | pro | 3.4.0-1 | vulnerable |
| Ubuntu | libarchive | pro | 3.4.0-1build1 | vulnerable |
| Ubuntu | libarchive | pro | 3.4.0-1ubuntu2 | vulnerable |
| Ubuntu | libarchive | pro | 3.4.0-2ubuntu1 | vulnerable |
| Ubuntu | libarchive | pro | 3.4.0-2ubuntu1.1 | vulnerable |
| Ubuntu | libarchive | pro | 3.4.0-2ubuntu1.2 | vulnerable |
| Ubuntu | libarchive | pro | 3.4.0-2ubuntu1.3 | vulnerable |
| Ubuntu | libarchive | pro | 3.4.0-2ubuntu1.4 | vulnerable |
| Ubuntu | libarchive | pro | 3.4.0-2ubuntu1.5 | vulnerable |
| Ubuntu | libarchive | pro | 3.4.0-2ubuntu1.5+esm1 | fixed |
| Ubuntu | libarchive | 22.04 | 3.4.3-2 | vulnerable |
| Ubuntu | libarchive | 22.04 | 3.4.3-2build1 | vulnerable |
| Ubuntu | libarchive | 22.04 | 3.5.2-1 | vulnerable |
| Ubuntu | libarchive | 22.04 | 3.5.2-1ubuntu1 | vulnerable |
| Ubuntu | libarchive | 22.04 | 3.6.0-1ubuntu1 | vulnerable |
| Ubuntu | libarchive | 22.04 | 3.6.0-1ubuntu1.1 | vulnerable |
| Ubuntu | libarchive | 22.04 | 3.6.0-1ubuntu1.2 | vulnerable |
| Ubuntu | libarchive | 22.04 | 3.6.0-1ubuntu1.3 | vulnerable |
| Ubuntu | libarchive | 22.04 | 3.6.0-1ubuntu1.4 | vulnerable |
| Ubuntu | libarchive | 22.04 | 3.6.0-1ubuntu1.5 | vulnerable |
| Ubuntu | libarchive | 22.04 | 3.6.0-1ubuntu1.6 | fixed |
| Ubuntu | libarchive | 24.04 | 3.6.2-1ubuntu1 | vulnerable |
| Ubuntu | libarchive | 24.04 | 3.7.2-1ubuntu1 | vulnerable |
| Ubuntu | libarchive | 24.04 | 3.7.2-1ubuntu2 | vulnerable |
| Ubuntu | libarchive | 24.04 | 3.7.2-1.1ubuntu2 | vulnerable |
| Ubuntu | libarchive | 24.04 | 3.7.2-2 | vulnerable |
| Ubuntu | libarchive | 24.04 | 3.7.2-2ubuntu0.1 | vulnerable |
| Ubuntu | libarchive | 24.04 | 3.7.2-2ubuntu0.2 | vulnerable |
| Ubuntu | libarchive | 24.04 | 3.7.2-2ubuntu0.3 | vulnerable |
| Ubuntu | libarchive | 24.04 | 3.7.2-2ubuntu0.4 | vulnerable |
| Ubuntu | libarchive | 24.04 | 3.7.2-2ubuntu0.5 | vulnerable |
| Ubuntu | libarchive | 24.04 | 3.7.2-2ubuntu0.6 | fixed |
| Ubuntu | libarchive | 25.10 | 3.7.7-0ubuntu2 | vulnerable |
| Ubuntu | libarchive | 25.10 | 3.7.7-0ubuntu2.1 | vulnerable |
| Ubuntu | libarchive | 25.10 | 3.7.7-0ubuntu2.2 | vulnerable |
| Ubuntu | libarchive | 25.10 | 3.7.7-0ubuntu3 | vulnerable |
| Ubuntu | libarchive | 25.10 | 3.7.7-0ubuntu3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libarchive | source | sid | 3.8.6-1 | not yet assigned | Not reported | [1130753] |
| Debian | libarchive | source | forky | 3.8.6-1 | not yet assigned | Not reported | [1130753] |
| Debian | libarchive | source | trixie | 3.7.4-4+deb13u1 | not yet assigned | Not reported | [1130753] |
| Debian | libarchive | source | bookworm | 3.6.2-1+deb12u4 | not yet assigned | Not reported | [1130753] |
| Ubuntu | libarchive | deb | noble | 3.6.2-1+deb12u4 | Not reported | Not reported | Not reported |
| Ubuntu | libarchive | deb | noble | 3.7.2-2ubuntu0.6 | Not reported | Not reported | Not reported |
| Ubuntu | libarchive-dev | deb | noble | 3.7.2-2ubuntu0.6 | Not reported | Not reported | Not reported |
| Ubuntu | libarchive-tools | deb | noble | 3.7.2-2ubuntu0.6 | Not reported | Not reported | Not reported |
| Ubuntu | libarchive13t64 | deb | noble | 3.7.2-2ubuntu0.6 | Not reported | Not reported | Not reported |
| Ubuntu | libarchive | deb | pro | 3.4.0-2ubuntu1.5+esm1 | Not reported | UBUNTU-CVE-2026-4111 | Not reported |
| Ubuntu | libarchive | deb | 22.04 | 3.6.0-1ubuntu1.6 | Not reported | UBUNTU-CVE-2026-4111 | Not reported |
| Ubuntu | libarchive | deb | 24.04 | 3.7.2-2ubuntu0.6 | Not reported | UBUNTU-CVE-2026-4111 | Not reported |
| Ubuntu | libarchive | deb | 25.10 | 3.7.7-0ubuntu3.1 | Not reported | UBUNTU-CVE-2026-4111 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libarchive13]Fixed
Source package: [libarchive]
Details (4)
3.6.2-1+deb12u4· amd64 · bookwormFixed · Fixed:
3.6.2-1+deb12u4usn · libarchive · debian · bookworm
3.6.2-1+deb12u4· arm64 · bookwormFixed · Fixed:
3.6.2-1+deb12u4usn · libarchive · debian · bookworm
3.6.2-1+deb12u5· amd64 · bookworm-securityFixed · Fixed:
3.6.2-1+deb12u4usn · libarchive · debian · bookworm
3.6.2-1+deb12u5· arm64 · bookworm-securityFixed · Fixed:
3.6.2-1+deb12u4usn · libarchive · debian · bookworm
- [libarchive-dev]Fixed
Source package: [libarchive]
Details (4)
3.6.2-1+deb12u4· amd64 · bookwormFixed · Fixed:
3.6.2-1+deb12u4usn · libarchive · debian · bookworm
3.6.2-1+deb12u4· arm64 · bookwormFixed · Fixed:
3.6.2-1+deb12u4usn · libarchive · debian · bookworm
3.6.2-1+deb12u5· amd64 · bookworm-securityFixed · Fixed:
3.6.2-1+deb12u4usn · libarchive · debian · bookworm
3.6.2-1+deb12u5· arm64 · bookworm-securityFixed · Fixed:
3.6.2-1+deb12u4usn · libarchive · debian · bookworm
- [libarchive-tools]Fixed
Source package: [libarchive]
Details (4)
3.6.2-1+deb12u4· amd64 · bookwormFixed · Fixed:
3.6.2-1+deb12u4usn · libarchive · debian · bookworm
3.6.2-1+deb12u4· arm64 · bookwormFixed · Fixed:
3.6.2-1+deb12u4usn · libarchive · debian · bookworm
3.6.2-1+deb12u5· amd64 · bookworm-securityFixed · Fixed:
3.6.2-1+deb12u4usn · libarchive · debian · bookworm
3.6.2-1+deb12u5· arm64 · bookworm-securityFixed · Fixed:
3.6.2-1+deb12u4usn · libarchive · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-4111]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-4111]
- [https://security-tracker.debian.org/tracker/CVE-2026-4111]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4111.json]
- [https://ubuntu.com/security/notices/USN-8147-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0785.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]