CVE-2026-78322: File-Roller Stack Buffer Overflow DoS

CVE-2026-78322 Overview

A stack buffer overflow flaw exists in GNOME file-roller, the default archive manager for the GNOME desktop environment. When file-roller opens or extracts a malicious 7z or RAR archive that contains a file entry with an excessively long path, the progress-line parsing routine copies the path into a fixed-size stack buffer using an unbounded string copy. The out-of-bounds write corrupts the stack and terminates the process, resulting in a denial of service. Exploitation requires a user to open or extract the crafted archive with file-roller.

Critical Impact
Opening a crafted 7z or RAR archive with file-roller triggers a stack buffer overflow [CWE-120] that crashes the application and denies archive access to the user.

Affected Products

GNOME file-roller archive manager
Linux distributions shipping file-roller as the default archive tool (including Red Hat–based distributions)
Desktop environments that invoke file-roller for 7z and RAR extraction

Discovery Timeline

2026-08-25 - CVE-2026-78322 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78322

Vulnerability Analysis

The flaw resides in file-roller's progress-line parsing logic, which processes output emitted by external archive backends during 7z and RAR extraction. Each progress line typically contains the path of the file currently being processed. file-roller copies this path into a fixed-size stack buffer using an unbounded string copy operation, without validating that the source length fits inside the destination buffer.

When an archive entry contains a path longer than the buffer, the copy writes past the buffer boundary and corrupts adjacent stack frame data, including saved return addresses and stack canaries. On systems built with stack protection, the corruption is detected and the process aborts. The result is a reliable crash of the archive manager whenever the crafted entry is processed. This is classified as a classic buffer copy without checking size of input [CWE-120].

Root Cause

The root cause is the use of an unbounded string copy (a strcpy-style operation) into a fixed-size stack buffer while parsing progress output from archive backends. The code assumes that file paths reported by the backend fit within the buffer, but archive metadata is attacker-controlled. No length check or bounded copy such as strncpy or g_strlcpy guards the destination.

Attack Vector

An attacker crafts a 7z or RAR archive containing a file entry with an excessively long path and delivers it through email attachments, web downloads, shared file systems, or removable media. The victim opens or extracts the archive using file-roller. During extraction, the backend emits a progress line containing the malicious path, which file-roller copies into the vulnerable stack buffer and crashes. User interaction is required, and impact is limited to availability.

No verified proof-of-concept code is available. See the GNOME File Roller Commit and GNOME File Roller Issue #327 for the upstream fix and technical discussion.

Detection Methods for CVE-2026-78322

Indicators of Compromise

Unexpected termination or crash reports for the file-roller process shortly after a user opens a 7z or RAR archive.
Core dumps or abrt reports referencing stack smashing or __stack_chk_fail in file-roller.
Presence of 7z or RAR archives containing file entries with paths substantially longer than typical filesystem limits.

Detection Strategies

Monitor process termination events for file-roller correlated with recent archive open or extract actions.
Inspect archives received through email or downloads for entries whose path length exceeds 255 bytes, which is atypical for benign archives.
Alert on repeated file-roller crashes across multiple users, which may indicate a distributed malicious archive.

Monitoring Recommendations

Forward Linux desktop crash telemetry (systemd-coredump, abrt) into a central logging or SIEM pipeline for correlation.
Track package versions of file-roller across the Linux fleet to identify unpatched hosts.
Review mail gateway and file transfer logs for suspicious 7z or RAR attachments delivered to end users.

How to Mitigate CVE-2026-78322

Immediate Actions Required

Apply the upstream patch referenced in the GNOME File Roller Commit or the distribution security update once available.
Instruct users not to open 7z or RAR archives from untrusted sources with file-roller until the patch is deployed.
Prioritize patching multi-user Linux systems and shared workstations where archive handling is common.

Patch Information

The upstream fix is tracked in the GNOME file-roller repository. Distribution advisories, including the Red Hat CVE-2026-78322 Advisory and Red Hat Bugzilla Report #2521767, coordinate the backport into supported package versions. Apply vendor updates through standard package management once released.

Workarounds

Use an alternative archive tool such as 7z, unrar, or ark when handling untrusted 7z or RAR archives.
Block or quarantine 7z and RAR attachments at the mail gateway for users who do not require them.
Extract untrusted archives inside a sandbox or disposable virtual machine to contain any process crash.

bash

# Verify the installed file-roller version and update via the distribution package manager
rpm -q file-roller        # Red Hat / Fedora based systems
dpkg -l | grep file-roller # Debian / Ubuntu based systems

# Apply security updates once the patched package is published
sudo dnf update file-roller
sudo apt update && sudo apt install --only-upgrade file-roller