CVE-2017-14502: Buffer Overflow
Last updated 25 August 2025
Other sources
libarchive is vulnerable to a buffer overflow, caused by improper bounds checking by the readheader function in archivereadsupportformatrar.c. By persuading a victim to open a specially-crafted RAR file, a remote attacker could overflow a buffer and execute arbitrary code on the system.
— IBM
readheader in archivereadsupportformatrar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archivereadformatrarreadheader.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-14502?
CVE-2017-14502 is a vulnerability in libarchive 3.3.2 that allows a remote attacker to execute arbitrary code on the system by exploiting a buffer overflow in the read_header function in archive_read_support_format_rar.c.
How does CVE-2017-14502 impact libarchive?
CVE-2017-14502 can lead to a buffer overflow in libarchive, potentially allowing an attacker to execute arbitrary code on the system.
Which versions of libarchive are affected by CVE-2017-14502?
CVE-2017-14502 affects libarchive version 3.3.2.
What is the severity of CVE-2017-14502?
CVE-2017-14502 has a severity rating of 7.8 (High).
How can I fix CVE-2017-14502 in libarchive?
To fix CVE-2017-14502 in libarchive, it is recommended to update to a version that includes the fix, such as version 3.3.3 or later.