REDHAT-BUG-2505492: Integer Overflow
A signed integer overflow flaw was found in libarchive's ZIP writer. The issue occurs in the archivewritezipheader function in archivewritesetformatzip.c when writing a ZIP entry with a known file size while ZIP encryption (e.g., AES-256) is enabled. When the entry size is close to INT64MAX, adding the encryption overhead (additionalsize) to zip->entryuncompressedsize triggers a signed integer overflow, leading to undefined behavior per the C standard. This could result in incorrect Zip64 extension decisions or potential memory corruption.
The vulnerability is in the write path only and requires both ZIP encryption to be enabled and a file size near INT64MAX, making real-world exploitation unlikely.
Upstream issue: https://github.com/libarchive/libarchive/issues/3225 Upstream fix: https://github.com/libarchive/libarchive/pull/3228
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable ZIP encryption in libarchive (e.g., AES-256) for ZIP creation to avoid the signed integer overflow triggered in the archive_write_zip_header write path when encryption is enabled.
libarchive ZIP writer ZIP encryption (e.g., AES-256) enabled = disable
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2505492?
The severity of REDHAT-BUG-2505492 is classified as low.
How do I fix REDHAT-BUG-2505492?
To address REDHAT-BUG-2505492, update to the latest version of libarchive that includes the patch for the integer overflow flaw.
What does REDHAT-BUG-2505492 affect?
REDHAT-BUG-2505492 affects the ZIP writer component of the libarchive library.
What flaw is described in REDHAT-BUG-2505492?
REDHAT-BUG-2505492 describes a signed integer overflow flaw in the archive_write_zip_header function when handling ZIP entries with large file sizes.
When was REDHAT-BUG-2505492 published?
REDHAT-BUG-2505492 was published on July 21, 2026.