CVE-2026-24857: 
NixOS vulnerability analysis and mitigation

CVE-2026-24857 is a heap-based buffer overflow vulnerability in bulk_extractor, a digital forensics tool, affecting its embedded unrar code in the RAR PPM LZ decoding path. The vulnerability exists in versions 1.4 through 2.1.1 and was publicly disclosed on January 28, 2026 via a GitHub Security Advisory. A crafted RAR archive embedded in a disk image triggers an out-of-bounds write in the Unpack::CopyString function, with potential for remote code execution. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is a heap-based buffer overflow (CWE-122) combined with an out-of-bounds write (CWE-787) in src/rar/unpack.cpp within the Unpack::CopyString function. The fast-path bounds check (if (SrcPtr < MAXWINSIZE - MAX_LZ_MATCH && UnpPtr < MAXWINSIZE - MAX_LZ_MATCH)) fails to verify that UnpPtr + Length stays within the 4 MiB window boundary. In PPM LZ mode, Length is computed as LengthByte + 32 (up to 287), and when UnpPtr is near the end of the heap buffer, the copy operation writes past the allocated region. An attacker can craft a RAR stream with a controlled Length and Distance to trigger this overflow via the PPM LZ branch (if (NextCh == 4) { CopyString(Length + 32, Distance + 2); }), confirmed with ASAN builds of bulk_extractor 2.1.1 (GitHub Advisory).

Successful exploitation causes an application crash (confirmed under ASAN) and likely memory corruption in production builds, impacting availability and potentially integrity and confidentiality. The vulnerability carries a realistic potential for remote code execution given the nature of heap buffer overflows, which could allow an attacker to execute arbitrary code in the context of the bulk_extractor process. Affected versions span bulk_extractor 1.4 through 2.1.1, and any forensic workflow that automatically processes untrusted disk images or RAR archives is at risk (GitHub Advisory, Red Hat CVE).

A proof-of-concept exploit script (make_ppm_overflow_rar.py) is publicly available in the GitHub Security Advisory, demonstrating reliable crash reproduction under ASAN builds. The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT, and no authentication or user interaction is required to trigger the vulnerability. There is no current evidence of in-the-wild exploitation, and the EPSS score is approximately 0.042% (GitHub Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

1. Craft the malicious RAR: Use the publicly available PoC script make_ppm_overflow_rar.py to generate a crafted RAR4 file (/tmp/ppm_overflow.rar) that encodes a PPM LZ stream with a large Length value (up to 287) and positions UnpPtr near the end of the 4 MiB window to trigger the overflow in Unpack::CopyString.
2. Embed RAR in a disk image: Create a raw disk image and embed the crafted RAR at a known offset (e.g., 1 MB): dd if=/dev/zero of=/tmp/poc.img bs=1m count=8 followed by dd if=/tmp/ppm_overflow.rar of=/tmp/poc.img bs=1 seek=1048576 conv=notrunc.
3. Deliver the disk image: Supply the crafted disk image to a target system running a vulnerable version of bulk_extractor (1.4–2.1.1), either by placing it in a directory that is automatically scanned or by social engineering a forensic analyst into processing it.
4. Trigger processing: Cause bulk_extractor to scan the image with the RAR scanner enabled: bulk_extractor -q -x all -e rar -o /tmp/output /tmp/poc.img. The embedded RAR triggers the PPM LZ decoding path, causing the out-of-bounds write in Unpack::CopyString.
5. Achieve impact: In production builds, this results in memory corruption that may be leveraged for code execution; in ASAN builds, it produces an immediate crash with a heap-buffer-overflow report (GitHub Advisory).

• File System: Presence of crafted RAR files or disk images with embedded RARs in directories processed by bulk_extractor; unexpected files named ppm_overflow.rar, poc.img, or similar in temporary directories.
• Process: bulk_extractor process terminating abnormally or producing core dumps; child processes or crash reporters spawned unexpectedly from bulk_extractor.
• Logs: ASAN output containing ERROR: AddressSanitizer: heap-buffer-overflow referencing Unpack::CopyString in unpack.cpp:230 and scan_rar in scan_rar.cpp:665; bulk_extractor log entries showing ReadTables: PPM mode followed by abnormal termination.
• Network: Unusual inbound delivery of large disk image files or RAR archives to forensic workstations from untrusted external sources (GitHub Advisory).

A patch was released on February 9, 2026 via the GitHub Security Advisory (GHSA-rh8m-9xrx-q64q); users should update bulk_extractor to a version beyond 2.1.1 as soon as it becomes available. As an immediate workaround, avoid processing untrusted RAR archives or disk images from untrusted sources, and disable the RAR scanner using the -x rar flag when scanning untrusted input. Running bulk_extractor in isolated environments (e.g., containers or VMs) with memory protection mechanisms (ASAN, stack canaries) enabled can limit the impact of exploitation. Network segmentation should be applied to restrict access to systems running bulk_extractor (GitHub Advisory, Red Hat CVE).

Red Hat has tracked the vulnerability under their CVE database, indicating awareness among enterprise Linux vendors (Red Hat CVE). Security aggregators including INCIBE-CERT, VulnDB, and CIRCL have indexed the advisory, reflecting standard community monitoring. No notable researcher commentary or significant social media discussion beyond automated CVE tracking has been observed at this time.