Bug 2505492 (CVE-2026-16517) - CVE-2026-16517 libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header
Summary: CVE-2026-16517 libarchive: libarchive: Signed Integer Overflow in archive_wri...
Keywords:
Status: NEW
Alias: CVE-2026-16517
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-21 22:33 UTC by OSIDB Bzimport
Modified: 2026-09-21 22:51 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:69553 0 None None None 2026-09-21 22:51:27 UTC

Description OSIDB Bzimport 2026-07-21 22:33:49 UTC 
A signed integer overflow flaw was found in libarchive's ZIP writer. The issue occurs in the archive_write_zip_header function in archive_write_set_format_zip.c when writing a ZIP entry with a known file size while ZIP encryption (e.g., AES-256) is enabled. When the entry size is close to INT64_MAX, adding the encryption overhead (additional_size) to zip->entry_uncompressed_size triggers a signed integer overflow, leading to undefined behavior per the C standard. This could result in incorrect Zip64 extension decisions or potential memory corruption.

The vulnerability is in the write path only and requires both ZIP encryption to be enabled and a file size near INT64_MAX, making real-world exploitation unlikely.

Upstream issue: https://github.com/libarchive/libarchive/issues/3225
Upstream fix: https://github.com/libarchive/libarchive/pull/3228
Comment 1 Jon Orris 2026-09-21 22:51:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:69553 https://access.redhat.com/errata/RHSA-2026:69553
Note You need to log in before you can comment on or make changes to this bug.