CVE-2024-26256: 
vulnerability analysis and mitigation

CVE-2024-26256 is a Remote Code Execution vulnerability affecting Libarchive, discovered in early 2024. The vulnerability impacts versions of Libarchive prior to 3.7.4, as well as various operating systems that bundle Libarchive, including Windows 11 and Fedora (Libarchive Release, Microsoft Advisory).

The vulnerability is classified as a heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787) in the RAR e8 filter functionality. The issue occurs during the processing of RAR archives that use the e8 bytecode filter, which is designed to make x86 code more compressible by translating relative branches into absolute ones. The vulnerability has a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (OSS Security, NVD).

The vulnerability allows an attacker to potentially achieve remote code execution through a specially crafted RAR archive. The flaw could lead to unauthorized access to the system with the ability to read and write to the entire address space during decompression, potentially compromising the confidentiality, integrity, and availability of the affected system (OSS Security).

The vulnerability requires local access and user interaction (opening a malicious RAR archive). The attack complexity is considered low, requiring no special privileges to execute (Microsoft Advisory).

The vulnerability has been fixed in Libarchive version 3.7.4. Various distributions have also released security updates, including Fedora 39 (version 3.7.1-2.fc39) and Fedora 40 (version 3.7.2-4.fc40). The fix involves correcting the length parameter validation in the e8 filter functionality (Libarchive Release, Fedora Update).

Security researchers, including Will Dormann, have noted that while the CVE was initially issued by Microsoft's CNA for their bundled version of libarchive, the fix is available for other platforms from the open source upstream. The vulnerability has garnered attention from the security community due to its potential impact on widely-used archive processing functionality (OSS Security).