CVE-2026-16517: Libarchive: libarchive: signed integer overflow in archive_write_zip_header
A signed integer overflow flaw was found in libarchive's ZIP writer. The issue occurs in the archivewritezipheader function in archivewritesetformatzip.c when writing a ZIP entry with a known file size while ZIP encryption (e.g., AES-256) is enabled. When the entry size is close to INT64MAX, adding the encryption overhead (additionalsize) to zip->entryuncompressedsize triggers a signed integer overflow, leading to undefined behavior per the C standard. This could result in incorrect Zip64 extension decisions or potential memory corruption.
The vulnerability is in the write path only and requires both ZIP encryption to be enabled and a file size near INT64MAX, making real-world exploitation unlikely.
Upstream issue: https://github.com/libarchive/libarchive/issues/3225 Upstream fix: https://github.com/libarchive/libarchive/pull/3228
Other sources
A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16517?
The severity of CVE-2026-16517 is classified as low with a score of 2.9.
How do I fix CVE-2026-16517?
To fix CVE-2026-16517, update libarchive to the latest version that addresses this signed integer overflow vulnerability.
What causes CVE-2026-16517?
CVE-2026-16517 is caused by a signed integer overflow in the archive_write_zip_header function when writing ZIP entries with large file sizes while ZIP encryption is enabled.
What is affected by CVE-2026-16517?
CVE-2026-16517 affects the libarchive library when it is used for writing ZIP files.
What is the impact of CVE-2026-16517?
The impact of CVE-2026-16517 includes potential data corruption or unexpected behavior during ZIP file creation.