CVE Watch15 jul 2026

CVE-2026-4111

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() process

CVSS

7.5

Alto

EPSS

0.7%

p49

KEV

—

Exploit Today

0-100

Publicado: 13 mar 2026 · Última mod.: 15 jul 2026 · CWE-835

EPSS · 30d

0.7%EPSS · 30 días0.7%

2026-06-302026-07-17

Descripción técnica

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-48907.5 ALT

93.6%

——28A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.3d CVE-2026-428997.5 ALT

82.4%

——25Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.3d CVE-2026-331167.5 ALT

80.0%

——24Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.3d CVE-2026-465227.5 ALT

76.7%

——23ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue.3d CVE-2023-301887.5 ALT

73.3%

——22Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.9d CVE-2022-233527.5 ALT

72.6%

——22An issue in BigAnt Software BigAnt Server v5.6.06 can lead to a Denial of Service (DoS).9d