Every CVE Search/ Get API key

CVE-2024-26256

Libarchive Remote Code Execution Vulnerability

7.8 HighFix available

Libarchive Remote Code Execution Vulnerability

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

87.9%Up 87.9 points since Apr 10, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.8

Libarchive Remote Code Execution Vulnerability

Libarchive Remote Code Execution Vulnerability

Record
CVE-2024-26256
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2024-23532 7.8

Libarchive Remote Code Execution Vulnerability

Record
EUVD-2024-23532
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Updated
2026-11-02
GitHub AdvisoriesGHSA-2jc9-36w4-pmqw 7.8

libarchive Remote Code Execution Vulnerability

libarchive Remote Code Execution Vulnerability

Record
GHSA-2jc9-36w4-pmqw
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122, CWE-787
Updated
2026-11-02
NVD 7.8

Libarchive Remote Code Execution Vulnerability

Record
CVE-2024-26256
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-122, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2024-26256 7.8

Libarchive Remote Code Execution Vulnerability

Record
ALPINE-CVE-2024-26256
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2024-26256 7.8
Record
BELL-CVE-2024-26256
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSV 7.8

Libarchive Remote Code Execution Vulnerability

Record
CVE-2024-26256
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-26256 7.8

Libarchive Remote Code Execution Vulnerability

Record
DEBIAN-CVE-2024-26256
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVJLSEC-2025-239 7.8

Libarchive Remote Code Execution Vulnerability

Libarchive Remote Code Execution Vulnerability

Record
JLSEC-2025-239
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-26256 7.8

Libarchive Remote Code Execution Vulnerability

Record
UBUNTU-CVE-2024-26256
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-42370 No score

CVE-2024-26256 affecting package libarchive for versions less than 3.7.1-2

Libarchive Remote Code Execution Vulnerability

Record
AZL-42370
Updated
2026-11-02
OSVAZL-42383 No score

CVE-2024-26256 affecting package libarchive for versions less than 3.6.1-3

Libarchive Remote Code Execution Vulnerability

Record
AZL-42383
Updated
2026-11-02
OSVMGASA-2024-0154 No score

Updated libarchive packages fix security vulnerability

Remote Code Execution Vulnerability. (CVE-2024-26256)

Record
MGASA-2024-0154
Updated
2026-11-02
OSVopenSUSE-SU-2024:13929-1 No score

bsdtar-3.7.4-1.1 on GA media

These are all security issues fixed in the bsdtar-3.7.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13929-1
Updated
2026-11-02
OSVSUSE-SU-2025:20087-1 No score

Security update for libarchive

This update for libarchive fixes the following issues:

  • CVE-2024-48958: Fixed out-of-bounds access in execute_filter_delta (bsc#1231624).
  • CVE-2024-20697: Fixed out-of-bounds remote code execution vulnerability (bsc#1225972).
  • CVE-2024-48957: Fixed out-of-bounds access in execute_filter_audio (bsc#1231544).
Record
SUSE-SU-2025:20087-1
Updated
2026-11-02
OSVSUSE-SU-2025:20257-1 No score

Security update for libarchive

This update for libarchive fixes the following issues:

  • CVE-2025-1632: Fixed null pointer dereference in bsdunzip.c (bsc#1237606)
  • CVE-2025-25724: Fixed Buffer Overflow vulnerability in libarchive (bsc#1238610)
  • CVE-2024-48958: Fixed out-of-bounds access in execute_filter_delta (bsc#1231624)
  • CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability (also attributed CVE-2024-26256) (CVE-2024-26256, bsc#1225972)
  • CVE-2024-48957: Fixed out-of-bounds access in execute_filter_audio (bsc#1231544)
  • CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971)
Record
SUSE-SU-2025:20257-1
Updated
2026-11-02
OSVUSN-6805-1 No score

libarchive vulnerability

It was discovered that libarchive incorrectly handled certain RAR archive files. An attacker could possibly use this issue to execute arbitrary code or cause a crash.

Record
USN-6805-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libarchive
Alpine:v3.16
 before 3.7.4-r0
3.7.4-r0
libarchive
Alpine:v3.17
 before 3.7.4-r0
3.7.4-r0
libarchive
Alpine:v3.18
 before 3.7.4-r0
3.7.4-r0
libarchive
Alpine:v3.19
 before 3.7.4-r0
3.7.4-r0
libarchive
Alpine:v3.20
 before 3.7.4-r0
3.7.4-r0
libarchive
Alpine:v3.21
 before 3.7.4-r0
3.7.4-r03.7.5-r0
libarchive
Alpine:v3.22
 before 3.7.4-r0
3.7.4-r03.7.5-r0
libarchive
Alpine:v3.23
 before 3.7.4-r0
3.7.4-r03.7.5-r0
libarchive
Alpine:v3.24
 before 3.7.4-r0
3.7.4-r03.7.5-r0
libarchive
Azure Linux:3
 before 3.7.1-2
3.7.1-2
Show 13 moreShow less
Affected packages
PackageAffectedFixed
libarchive
Azure Linux:2
 before 3.6.1-3
3.6.1-3
libarchive
Alpaquita:23
 3.6.1-r1 up to 3.7.4-r0
3.7.4-r0
libarchive
Alpaquita:stream
 3.6.2-r1 up to 3.7.4-r0
3.7.4-r0
libarchive
Debian:12
 before 3.6.2-1+deb12u1, plus listed versions
3.6.2-1
3.6.2-1+deb12u1
libarchive
Debian:13
 before 3.7.2-2.1
3.7.2-2.1
libarchive
Debian:14
 before 3.7.2-2.1
3.7.2-2.1
LibArchive_jll
Julia
 before 3.7.4+0
3.7.4+0
libarchive
Mageia:9
 before 3.6.2-5.1.mga9
3.6.2-5.1.mga9
libarchive
SUSE:Linux Micro 6.0
From an advisory covering 4 CVEs
 before 3.6.2-4.1
3.6.2-4.1
libarchive
SUSE:Linux Micro 6.1
From an advisory covering 7 CVEs
 before 3.7.4-slfo.1.1_2.1
3.7.4-slfo.1.1_2.1
libarchive
Ubuntu:22.04:LTS
 before 3.6.0-1ubuntu1.1, plus listed versions
3.4.3-23.4.3-2build13.5.2-13.5.2-1ubuntu13.6.0-1ubuntu1
3.6.0-1ubuntu1.1
libarchive
Ubuntu:24.04:LTS
 before 3.7.2-2ubuntu0.1, plus listed versions
3.6.2-1ubuntu13.7.2-1ubuntu13.7.2-1ubuntu23.7.2-1.1ubuntu23.7.2-2
3.7.2-2ubuntu0.1
bsdtar
openSUSE:Tumbleweed
 before 3.7.4-1.1
3.7.4-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-26256 is a high vulnerability (CVSS 7.8) in Libarchive, published April 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 87.9%, the 99th percentile. Fixed in libarchive 3.7.4-r0.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open