CVE-2026-4111

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.(CVE-2026-4111)

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive (CVE-2026-4111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive (CVE-2026-4111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive (CVE-2026-4111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive (CVE-2026-4111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

• CVE-2026-4111: Fix infinite loop in RAR5 decompression caused by block_length exceeding half the window size, leading to CPU-consuming denial-of-service

• CVE-2026-4111: Fix infinite loop in RAR5 decompression caused by block_length exceeding half the window size, leading to CPU-consuming denial-of-service

The updated packages fix bugs including security ones.

Double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack(). (CVE-2026-14164) Heap overflow oob read while parsing a tar archive contains a pax extended header. (CVE-2026-15028) A null pointer dereference vulnerability exists in the acl parser of libarchive. (CVE-2026-5745) Reading past eof may be triggered for piped file streams. (CVE-2025-5918) An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash). (CVE-2025-60753) Infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive. (CVE-2026-4111) Information disclosure via heap out-of-bounds read in rar archive processing. (CVE-2026-4424) Denial of service via malformed iso file processing. (CVE-2026-4426) Arbitrary code execution via integer overflow in iso9660 image processing. (CVE-2026-5121)

This update for libarchive fixes the following issues

• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).

Root has patched CVE-2026-4111 in the rootio-libarchive package for Root:Debian:12. Multiple fixed versions available.

This update for libarchive fixes the following issues

• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).

This update for libarchive fixes the following issues

• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).

This update for libarchive fixes the following issues

• CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).

This update for libarchive fixes the following issues

• CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).

This update for libarchive fixes the following issues

• CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).

This update for libarchive fixes the following issues

• CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).