CVE-2026-78322
File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.
- Record
CVE-2026-78322- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2026-65311
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.
- Record
EUVD-2026-65311- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qgv9-pfrp-f7x5
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive...
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.
- Record
GHSA-qgv9-pfrp-f7x5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.
- Record
CVE-2026-78322- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSV
File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.
- Record
CVE-2026-78322- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-78322
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.
- Record
DEBIAN-CVE-2026-78322- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVOESA-2026-3803
file-roller security update
File Roller is an archive manager that you can create and modify archives; view the content of an archive;view and modify a file contained in the archive; extract files from the archive.
Security Fix(es):
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.(CVE-2026-78322)
- Record
OESA-2026-3803- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-3804
file-roller security update
File Roller is an archive manager that you can create and modify archives; view the content of an archive;view and modify a file contained in the archive; extract files from the archive.
Security Fix(es):
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.(CVE-2026-78322)
- Record
OESA-2026-3804- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-3805
file-roller security update
File Roller is an archive manager that you can create and modify archives; view the content of an archive;view and modify a file contained in the archive; extract files from the archive.
Security Fix(es):
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.(CVE-2026-78322)
- Record
OESA-2026-3805- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-3806
file-roller security update
File Roller is an archive manager that you can create and modify archives; view the content of an archive;view and modify a file contained in the archive; extract files from the archive.
Security Fix(es):
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.(CVE-2026-78322)
- Record
OESA-2026-3806- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-3903
file-roller security update
File Roller is an archive manager that you can create and modify archives; view the content of an archive;view and modify a file contained in the archive; extract files from the archive.
Security Fix(es):
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.(CVE-2026-78322)
- Record
OESA-2026-3903- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-78322
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.
- Record
UBUNTU-CVE-2026-78322- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21667-1 No score
Security update for file-roller
This update for file-roller fixes the following issues:
Changes in file-roller:
- CVE-2026-78322: Check line length when parsing command output (bsc#1276442).
- Record
openSUSE-SU-2026:21667-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3960-1 No score
Security update for file-roller
This update for file-roller fixes the following issue:
- CVE-2026-78322: stack buffer overflow in parse_progress_line for 7z and RAR handlers (bsc#1276442).
- Record
SUSE-SU-2026:3960-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4007-1 No score
Security update for file-roller
This update for file-roller fixes the following issue:
- CVE-2026-78322: stack buffer overflow in parse_progress_line for 7z and RAR handlers (bsc#1276442).
- Record
SUSE-SU-2026:4007-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
file-rollerDebian:12 |
All versions, plus listed versions 43.0-143.1-144-144-244.1-1 Show 10 moreShow less44.3-144.4-144.5-144.6-144.6-244.6-344.6-444.6-544.7-144~beta-1 |
None known |
file-rollerDebian:13 |
All versions, plus listed versions 44.5-144.6-144.6-244.6-344.6-444.6-544.7-1 |
None known |
file-rollerDebian:14 |
before 44.7-1, plus listed versions 44.5-144.6-144.6-244.6-344.6-444.6-5 |
44.7-1 |
file-rolleropenEuler:20.03-LTS-SP4 |
before 3.30.1-4.oe2003sp4 | 3.30.1-4.oe2003sp4 |
file-rolleropenEuler:22.03-LTS-SP4 |
before 3.38.1-2.oe2203sp4 | 3.38.1-2.oe2203sp4 |
file-rolleropenEuler:24.03-LTS-SP1 |
before 43.0-3.oe2403sp1 | 43.0-3.oe2403sp1 |
file-rolleropenEuler:24.03-LTS-SP4 |
before 43.0-3.oe2403sp4 | 43.0-3.oe2403sp4 |
file-rolleropenEuler:24.03-LTS-SP3 |
before 43.0-3.oe2403sp3 | 43.0-3.oe2403sp3 |
file-rollerSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 3.20.3-15.12.1 | 3.20.3-15.12.1 |
file-rollerSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 |
before 43.1-150600.3.3.1 | 43.1-150600.3.3.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
file-rollerUbuntu:16.04:LTS |
All versions, plus listed versions 3.16.4-1ubuntu33.16.5-0ubuntu13.16.5-0ubuntu1.13.16.5-0ubuntu1.23.16.5-0ubuntu1.33.16.5-0ubuntu1.43.16.5-0ubuntu1.5 |
None known |
file-rollerUbuntu:18.04:LTS |
All versions, plus listed versions 3.26.1-0ubuntu13.26.2-0ubuntu13.26.2-3ubuntu13.28.0-1ubuntu13.28.0-1ubuntu1.13.28.0-1ubuntu1.23.28.0-1ubuntu1.3 |
None known |
file-rollerUbuntu:20.04:LTS |
All versions, plus listed versions 3.32.2-13.32.3-13.35.90-13.35.91-13.35.92-1 Show 6 moreShow less3.36.0-13.36.1-13.36.1-1ubuntu0.13.36.2-0ubuntu13.36.3-0ubuntu13.36.3-0ubuntu1.1 |
None known |
file-rollerUbuntu:22.04:LTS |
All versions, plus listed versions 3.40.0-23.40.0-33.40.0-43.41.90-13.42.0-1 |
None known |
file-rollerUbuntu:24.04:LTS |
All versions, plus listed versions 43.0-143.1-143.1-1build143.1-1build244.1-144.3-0ubuntu144.3-0ubuntu2 |
None known |
file-rollerUbuntu:26.04:LTS |
All versions, plus listed versions 44.5-144.6-144.6-244.6-3 |
None known |
file-rolleropenSUSE:Leap 16.0 |
before 44.5-bp160.2.1 | 44.5-bp160.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-78322 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 6, published August 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in file-roller 44.7-1.
References
access.redhat.com/security/cve/CVE-2026-78322
bugzilla.redhat.com/show_bug.cgi?id=2521767
gitlab.gnome.org/GNOME/file-roller/-/commit/ffb76dc866342cef6a4914873faaa880d14d5aa4
nvd.nist.gov/vuln/detail/CVE-2026-78322
github.com/advisories/GHSA-qgv9-pfrp-f7x5
Show 14 moreShow less
security-tracker.debian.org/tracker/CVE-2026-78322
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3803
suse.com/support/update/announcement/2026/suse-su-20263960-1
bugzilla.suse.com/1276442
ubuntu.com/security/CVE-2026-78322
cve.org/CVERecord?id=CVE-2026-78322