This vulnerability (CVE-2026-4424) exists in libarchive's handling of RAR archives on Red Hat Enterprise Linux 10. It is caused by improper validation of the LZSS sliding window size after transitions between compression methods, leading to a heap out-of-bounds read. This flaw allows a remote attacker to cause information disclosure of sensitive heap memory by providing a crafted RAR archive. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Red Hat has issued an important security advisory and released updated libarchive packages that fix this issue.

Successful exploitation of this vulnerability can lead to disclosure of sensitive heap memory information on affected systems running Red Hat Enterprise Linux 10. The vulnerability does not allow code execution or denial of service but can expose potentially sensitive data to unauthenticated remote attackers. The CVSS score of 7.5 reflects a high severity impact primarily due to confidentiality loss via a network vector without requiring privileges or user interaction.

Red Hat has released an important security update for libarchive in Red Hat Enterprise Linux 10 that addresses CVE-2026-4424. Users should apply the updated libarchive packages as provided in the Red Hat advisory RHSA-2026:8492 to remediate this vulnerability. Detailed update instructions are available at https://access.redhat.com/articles/11258. No other mitigations are indicated or required beyond applying the official patch.