CVE-2026-78322: 
Linux Red Hat vulnerability analysis and mitigation

CVE-2026-78322 is a stack buffer overflow vulnerability in GNOME file-roller, the default archive manager for the GNOME desktop environment. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's parse_progress_line() function copies the path into a fixed-size stack buffer using an unbounded strcpy() call, triggering a stack buffer overflow and causing the application to crash. The vulnerability was reported by Yukihiro Nakamura, disclosed on August 24, 2026, and fixed upstream in file-roller 44.7. It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-120 (Buffer Copy without Checking Size of Input), specifically in the parse_progress_line() functions within file-roller's 7z and RAR archive backends (src/fr-command-7z.c and src/fr-command-rar.c). File paths parsed from subprocess output (produced by the 7z or rar command-line tools) are copied via strcpy() into fixed-size stack buffers of 4196 and 4096 bytes respectively, with no length validation. An attacker crafts an archive containing a file entry whose path exceeds these buffer sizes; when a victim opens or extracts the archive in file-roller, the overflow is triggered. Practical code execution is considered difficult on hardened builds due to stack canaries, PIE, and ASLR, making denial of service the primary realistic impact. The upstream fix (commit ffb76dc866342cef6a4914873faaa880d14d5aa4, titled "Check line length when parsing command output") adds proper length validation before the copy (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation causes file-roller to terminate abruptly, resulting in a denial of service that disrupts archive management operations for the affected user. There is no confidentiality or integrity impact — the vulnerability has no effect on data exposure or data modification. While the CWE-120 classification theoretically allows for arbitrary code execution via buffer overflows, Red Hat notes that exploitation for code execution is considered difficult on hardened systems with stack canaries, PIE, and ASLR enabled (Red Hat CVE, Red Hat Bugzilla).

Exploitation requires user interaction — a victim must open or extract a specially crafted 7z or RAR archive using file-roller. No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat CVE).

1. Craft a malicious archive: Create a 7z or RAR archive containing a file entry with a file path exceeding 4096–4196 characters (the fixed stack buffer sizes used in file-roller's RAR and 7z backends respectively).
2. Deliver the archive to the victim: Distribute the crafted archive via email attachment, file sharing, a malicious download link, or any other social engineering vector to a user running a vulnerable version of file-roller.
3. Induce victim interaction: Convince the victim to open or extract the archive using file-roller (e.g., by double-clicking the archive file in the GNOME Files file manager, which invokes file-roller by default).
4. Trigger the overflow: When file-roller invokes the 7z or rar subprocess and parses its progress output, the excessively long file path is copied via strcpy() into the fixed-size stack buffer in parse_progress_line(), overflowing the buffer and causing file-roller to crash (denial of service) (Red Hat Bugzilla, Red Hat CVE).

• File System: Presence of a 7z or RAR archive file with an unusually large size or containing entries with excessively long path names (paths exceeding ~4096 characters).
• Process: Unexpected termination of the file-roller process shortly after opening or extracting an archive; crash reports or core dumps generated for the file-roller process.
• Logs: GNOME crash reporter (gnome-abrt) or system journal (journalctl) entries indicating a segmentation fault or abnormal termination of file-roller; entries referencing signal 11 (SIGSEGV) or signal 6 (SIGABRT) for the file-roller process.

The upstream fix is available in file-roller version 44.7, introduced via commit ffb76dc866342cef6a4914873faaa880d14d5aa4 ("Check line length when parsing command output") in the GNOME GitLab repository. Users should update to file-roller 44.7 or later once their distribution packages the fix. As an interim workaround, Red Hat advises avoiding opening or extracting untrusted 7z or RAR archives with file-roller until an updated package is installed (Red Hat CVE, Red Hat Bugzilla).

Red Hat acknowledged the vulnerability and credited Yukihiro Nakamura for the responsible disclosure. Red Hat's advisory notes that while the stack buffer overflow is a real flaw, arbitrary code execution is considered difficult on hardened Red Hat systems due to mitigations such as stack canaries, PIE, and ASLR, contextualizing the practical risk as primarily a denial of service (Red Hat CVE).