This vulnerability involves a signed integer overflow in the archive_write_zip_header function of libarchive's ZIP writer component in Red Hat Enterprise Linux 10. When ZIP encryption is enabled and the entry file size approaches INT64_MAX, adding encryption overhead causes an int64_t overflow. This overflow results in undefined behavior, which may cause incorrect decisions regarding the Zip64 extension or lead to memory corruption. The CVSS 3.1 base score is 2.9, reflecting low severity with local attack vector, high attack complexity, no privileges required, no user interaction, and only availability impact. The vendor advisory does not specify a patch or remediation level at this time.

The vulnerability can cause availability impact due to potential memory corruption or incorrect Zip64 extension handling when processing ZIP archives with encryption and very large file sizes. There is no impact on confidentiality or integrity. Exploitation requires local access with high attack complexity and no privileges or user interaction, limiting the practical risk. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16517 for current remediation guidance. Until a fix is available, avoid processing ZIP archives with encryption and file sizes near INT64_MAX to reduce risk. Monitor vendor updates for official fixes or workarounds.