CVE-2026-4111: Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archivereaddata() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.
Other sources
An Infinite Loop Denial-of-Service vulnerability exists in the RAR5 decompression implementation of libarchive. The flaw occurs in the uncompressfile() routine within archivereadsupportformatrar5.c due to a logical deadlock between the filter activation threshold and the half-window output limiter. When a specially crafted RAR5 archive is processed through archivereaddata(), the decompressor enters a state where neither the filter activation condition nor the output window progress condition can be satisfied. As a result, the loop continues indefinitely while consuming 100% CPU. Because the archive passes all CRC and checksum validation, the issue can be triggered using a valid-looking archive without authentication or user interaction. This allows attackers to exhaust worker threads or processing pipelines in applications that automatically extract or scan archives.
— Red Hat
Libarchive: infinite loop denial of service in rar5 decompression via archivereaddata() in libarchive
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4111?
CVE-2026-4111 has been classified as a denial of service vulnerability due to its ability to cause an infinite loop during RAR5 decompression.
How do I fix CVE-2026-4111?
To fix CVE-2026-4111, update the libarchive library to the latest patched version that addresses this vulnerability.
What products are affected by CVE-2026-4111?
CVE-2026-4111 affects the libarchive library, specifically any applications utilizing its RAR5 decompression features.
Can CVE-2026-4111 be exploited remotely?
Yes, CVE-2026-4111 can be exploited remotely if a maliciously crafted RAR5 archive is processed by an application using the vulnerable libarchive library.
What impact does CVE-2026-4111 have on system security?
The impact of CVE-2026-4111 is a denial of service, which can render applications unusable by causing them to hang indefinitely.