Every CVE Search/ Get API key

CVE-2026-16517

Libarchive: libarchive: signed integer overflow in archive_write_zip_header

2.9 LowFix available

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.10%Unchanged since Jul 22, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.9

Libarchive: libarchive: signed integer overflow in archive_write_zip_header

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

Record
CVE-2026-16517
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190
Updated
2026-11-06
EUVDEUVD-2026-47586 2.9

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

Record
EUVD-2026-47586
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-06
GitHub AdvisoriesGHSA-j8w5-8rj6-wpwf 2.9

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the...

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

Record
GHSA-j8w5-8rj6-wpwf
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
NVD 2.9

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

Record
CVE-2026-16517
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190
Updated
2026-11-06
OSVBELL-CVE-2026-16517 2.9
Record
BELL-CVE-2026-16517
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2026-16517 2.9

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

Record
DEBIAN-CVE-2026-16517
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-07
Show 8 moreShow less
OSVOESA-2026-3258 2.9

libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.(CVE-2026-16517)

Record
OESA-2026-3258
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2026:43818 4.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:43818
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:69553 3.9

Red Hat Security Advisory: libarchive security update

Record
RHSA-2026:69553
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:69553 3.9

Low: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

  • libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header (CVE-2026-15028)

  • libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header (CVE-2026-16517)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69553
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-16517 2.9

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

Record
UBUNTU-CVE-2026-16517
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2026:69553 No score

Low: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

  • libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header (CVE-2026-15028)
  • libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header (CVE-2026-16517)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69553
Updated
2026-11-02
OSVAZL-93231 No score

CVE-2026-16517 affecting package libarchive 3.7.7-7

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

Record
AZL-93231
Updated
2026-11-05
OSVUSN-8902-1 No score

libarchive vulnerability

It was discovered that libarchive had a signed integer overflow in its ZIP writer when handling encrypted entries with sizes near the maximum value. An attacker could possibly use this issue to cause libarchive to crash or execute arbitrary code.

Record
USN-8902-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bsdtar
AlmaLinux:10
From an advisory covering 2 CVEs
 before 3.7.7-11.el10_2
3.7.7-11.el10_2
libarchive
AlmaLinux:10
From an advisory covering 2 CVEs
 before 3.7.7-11.el10_2
3.7.7-11.el10_2
libarchive-devel
AlmaLinux:10
From an advisory covering 2 CVEs
 before 3.7.7-11.el10_2
3.7.7-11.el10_2
libarchive
Azure Linux:3
 through 3.7.7-7 None known
libarchive
Alpaquita:23
 3.6.1-r1 up to 3.8.8-r1
3.8.8-r1
libarchive
Alpaquita:25
 3.8.0-r0 up to 3.8.8-r1
3.8.8-r1
libarchive
Alpaquita:stream
 3.6.2-r1 up to 3.8.8-r1
3.8.8-r1
libarchive
Debian:12
 before 3.6.2-1+deb12u5, plus listed versions
3.6.2-13.6.2-1+deb12u13.6.2-1+deb12u23.6.2-1+deb12u33.6.2-1+deb12u4
3.6.2-1+deb12u5
libarchive
Debian:13
 All versions, plus listed versions
3.7.4-43.7.4-4+deb13u13.8.10-13.8.10-23.8.11-1
Show 7 moreShow less
3.8.4-13.8.5-13.8.6-13.8.7-13.8.8-13.8.8-23.8.9-1
 None known
libarchive
Debian:14
 before 3.8.9-1, plus listed versions
3.7.4-43.8.4-13.8.5-13.8.6-13.8.7-13.8.8-13.8.8-2
3.8.9-1
Show 28 moreShow less
Affected packages
PackageAffectedFixed
libarchive
openEuler:20.03-LTS-SP4
 before 3.4.3-16.oe2003sp4
3.4.3-16.oe2003sp4
libarchive
openEuler:22.03-LTS-SP4
 before 3.5.2-15.oe2203sp4
3.5.2-15.oe2203sp4
libarchive
openEuler:24.03-LTS-SP1
 before 3.7.1-13.oe2403sp1
3.7.1-13.oe2403sp1
libarchive
openEuler:24.03-LTS-SP3
 before 3.7.1-13.oe2403sp3
3.7.1-13.oe2403sp3
libarchive
openEuler:24.03-LTS-SP4
 before 3.7.1-13.oe2403sp4
3.7.1-13.oe2403sp4
bsdcat
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:3.8.8-3.1.hum1
0:3.8.8-3.1.hum1
bsdcpio
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:3.8.8-3.1.hum1
0:3.8.8-3.1.hum1
bsdtar
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:3.8.8-3.1.hum1
0:3.8.8-3.1.hum1
bsdunzip
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:3.8.8-3.1.hum1
0:3.8.8-3.1.hum1
libarchive
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:3.8.8-3.1.hum1
0:3.8.8-3.1.hum1
libarchive-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:3.8.8-3.1.hum1
0:3.8.8-3.1.hum1
bsdcat-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.7.7-11.el10_2
0:3.7.7-11.el10_2
bsdcpio-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.7.7-11.el10_2
0:3.7.7-11.el10_2
bsdtar
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.7.7-11.el10_2
0:3.7.7-11.el10_2
bsdtar-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.7.7-11.el10_2
0:3.7.7-11.el10_2
bsdunzip-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.7.7-11.el10_2
0:3.7.7-11.el10_2
libarchive-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.7.7-11.el10_2
0:3.7.7-11.el10_2
libarchive-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.7.7-11.el10_2
0:3.7.7-11.el10_2
libarchive-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.7.7-11.el10_2
0:3.7.7-11.el10_2
libarchive
Red Hat:enterprise_linux:10.2
From an advisory covering 2 CVEs
 before 0:3.7.7-11.el10_2
0:3.7.7-11.el10_2
libarchive
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:3.7.7-11.el10_2
0:3.7.7-11.el10_2
libarchive
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.1.2-5ubuntu13.1.2-7ubuntu13.1.2-7ubuntu23.1.2-7ubuntu2.13.1.2-7ubuntu2.2
Show 9 moreShow less
3.1.2-7ubuntu2.33.1.2-7ubuntu2.43.1.2-7ubuntu2.63.1.2-7ubuntu2.73.1.2-7ubuntu2.83.1.2-7ubuntu2.8+esm13.1.2-7ubuntu2.8+esm33.1.2-7ubuntu2.8+esm43.1.2-7ubuntu2.8+esm5
 None known
libarchive
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.2-11build13.1.2-11ubuntu0.16.04.13.1.2-11ubuntu0.16.04.23.1.2-11ubuntu0.16.04.33.1.2-11ubuntu0.16.04.4
Show 7 moreShow less
3.1.2-11ubuntu0.16.04.53.1.2-11ubuntu0.16.04.63.1.2-11ubuntu0.16.04.73.1.2-11ubuntu0.16.04.83.1.2-11ubuntu0.16.04.8+esm13.1.2-11ubuntu0.16.04.8+esm23.1.2-11ubuntu0.16.04.8+esm3
 None known
libarchive
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.2.2-3.13.2.2-3.1ubuntu0.13.2.2-3.1ubuntu0.23.2.2-3.1ubuntu0.33.2.2-3.1ubuntu0.4
Show 6 moreShow less
3.2.2-3.1ubuntu0.53.2.2-3.1ubuntu0.63.2.2-3.1ubuntu0.73.2.2-3.1ubuntu0.7+esm13.2.2-3.1ubuntu0.7+esm23.2.2-3.1ubuntu0.7+esm3
 None known
libarchive
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.4.0-13.4.0-1build13.4.0-1ubuntu23.4.0-2ubuntu13.4.0-2ubuntu1.1
Show 7 moreShow less
3.4.0-2ubuntu1.23.4.0-2ubuntu1.33.4.0-2ubuntu1.43.4.0-2ubuntu1.53.4.0-2ubuntu1.5+esm13.4.0-2ubuntu1.5+esm23.4.0-2ubuntu1.5+esm3
 None known
libarchive
Ubuntu:22.04:LTS
 before 3.6.0-1ubuntu1.9, plus listed versions
3.4.3-23.4.3-2build13.5.2-13.5.2-1ubuntu13.6.0-1ubuntu1
Show 8 moreShow less
3.6.0-1ubuntu1.13.6.0-1ubuntu1.23.6.0-1ubuntu1.33.6.0-1ubuntu1.43.6.0-1ubuntu1.53.6.0-1ubuntu1.63.6.0-1ubuntu1.73.6.0-1ubuntu1.8
3.6.0-1ubuntu1.9
libarchive
Ubuntu:24.04:LTS
 before 3.7.2-2ubuntu0.9, plus listed versions
3.6.2-1ubuntu13.7.2-1ubuntu13.7.2-1ubuntu23.7.2-1.1ubuntu23.7.2-2
Show 8 moreShow less
3.7.2-2ubuntu0.13.7.2-2ubuntu0.23.7.2-2ubuntu0.33.7.2-2ubuntu0.43.7.2-2ubuntu0.53.7.2-2ubuntu0.63.7.2-2ubuntu0.73.7.2-2ubuntu0.8
3.7.2-2ubuntu0.9
libarchive
Ubuntu:26.04:LTS
 before 3.8.5-1ubuntu2.3, plus listed versions
3.7.7-0ubuntu33.8.5-1ubuntu13.8.5-1ubuntu23.8.5-1ubuntu2.13.8.5-1ubuntu2.2
3.8.5-1ubuntu2.3

History

History
RecordedChangedSources
affectedCVE List, EUVD, NVD, OSV
affected
factsOSV
affectedEUVD, NVD, OSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-16517 is a low vulnerability (CVSS 2.9) in Red Hat Enterprise Linux 10, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 1st percentile. Fixed in libarchive 3.8.8-r1.

References

Show 29 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open