CVE-2026-16517: libarchive Buffer Overflow Vulnerability

CVE-2026-16517 Overview

CVE-2026-16517 is a signed integer overflow vulnerability [CWE-190] in the libarchive ZIP writer component. The flaw resides in the archive_write_zip_header function within archive_write_set_format_zip.c. When ZIP encryption is enabled and an entry file size approaches INT64_MAX, adding the encryption overhead to the entry size overflows the int64_t value. This overflow produces undefined behavior that can lead to incorrect Zip64 extension decisions or memory corruption. The issue affects libarchive builds used by Red Hat Enterprise Linux and other distributions that link against the library.

Critical Impact
A local attacker who supplies a crafted archive entry with ZIP encryption enabled can trigger undefined behavior in libarchive, potentially causing application crashes or corrupting archive metadata.

Affected Products

libarchive ZIP writer (archive_write_set_format_zip.c)
Red Hat Enterprise Linux packages linking libarchive (see RHSA-2026:43818)
Downstream utilities such as bsdtar that use the libarchive ZIP writer

Discovery Timeline

2026-07-21 - CVE-2026-16517 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16517

Vulnerability Analysis

The vulnerability is a signed integer overflow triggered during ZIP archive header construction. libarchive's ZIP writer computes the on-disk size of an encrypted entry by adding a fixed encryption overhead to the caller-supplied entry size. When the entry size is close to INT64_MAX, this arithmetic overflows the int64_t type. Signed integer overflow is undefined behavior in C, which means the compiler is free to optimize based on the assumption that it cannot occur. The resulting value then feeds into the logic that decides whether to emit a standard ZIP header or a Zip64 extension header, producing an inconsistent archive layout.

Root Cause

The root cause is the absence of a bounds check before the addition of entry_size + encryption_overhead in archive_write_zip_header. libarchive assumes the caller-provided size is well-formed and does not validate that the sum fits within int64_t. The overflow occurs only when ZIP encryption mode is enabled, so the code path is not exercised by default archive creation. See the Red Hat CVE-2026-16517 advisory for the full analysis.

Attack Vector

Exploitation requires local access and the ability to invoke a libarchive-based tool with ZIP encryption enabled against an attacker-controlled input. The attacker must supply an entry with a size close to INT64_MAX, which typically requires a sparse or crafted file. Attack complexity is high because the required size and encryption configuration must align. The impact is limited to availability, with a potential for memory corruption that would require additional primitives to escalate.

No public proof-of-concept code is available. The vulnerability is described in prose only. Refer to the Red Hat Bug Report #2505492 for reproducer discussion.

Detection Methods for CVE-2026-16517

Indicators of Compromise

Unexpected crashes or aborts in processes that invoke libarchive with ZIP encryption
Malformed ZIP archives whose central directory disagrees with local file header sizes
ZIP archives declaring entry sizes at or above 0x7FFFFFFFFFFFFFF0 in encrypted mode

Detection Strategies

Inventory installed libarchive package versions and compare against the fixed builds in RHSA-2026:43818
Enable UndefinedBehaviorSanitizer (UBSan) in development and QA builds to catch signed overflow at runtime
Add file-size validation in wrappers that call archive_write_header before passing user-supplied entries

Monitoring Recommendations

Monitor for repeated segmentation faults or aborts in bsdtar, libarchive-linked services, and archive-processing daemons
Alert on creation of ZIP archives whose declared entry sizes exceed practical filesystem limits
Log invocations of archive tools that use encryption flags in automated build or backup pipelines

How to Mitigate CVE-2026-16517

Immediate Actions Required

Apply the libarchive updates published in Red Hat Security Advisory RHSA-2026:43818
Audit applications that link libarchive and enable ZIP encryption, and restrict their use to trusted inputs
Restart long-running services that load libarchive after the package upgrade completes

Patch Information

Red Hat has published fixed packages through RHSA-2026:43818. The fix adds bounds checking before the encryption overhead is added to the entry size in archive_write_zip_header. Consult the vendor advisory for the specific package versions that resolve the issue on your distribution.

Workarounds

Disable ZIP encryption in libarchive-based workflows until the patch is deployed
Reject archive entries whose declared size exceeds the maximum file size supported by the target filesystem
Run archive-processing services under resource limits and separate user accounts to contain crashes

bash

# Verify the installed libarchive version against the fixed release
rpm -q libarchive
dnf update libarchive