This vulnerability in libarchive affects the RAR archive processing component due to improper validation of the LZSS sliding window size after transitions between compression methods, leading to a heap out-of-bounds read. Exploitation requires no privileges or user interaction and can disclose sensitive heap memory contents. The issue is tracked as CVE-2026-4424 and affects Red Hat Enterprise Linux 10. Red Hat has issued security advisories addressing this vulnerability and related fixes in libarchive packages, including updates for Red Hat OpenShift Container Platform 4.16.60. The advisories recommend upgrading to updated packages and container images to remediate the issue.

Successful exploitation allows a remote attacker to read sensitive heap memory information from a vulnerable system without authentication or user interaction. This information disclosure could potentially aid further attacks or leak sensitive data. The vulnerability does not impact integrity or availability directly but poses a confidentiality risk.

Red Hat has published multiple security advisories addressing CVE-2026-4424 with updated libarchive packages and container images. Users of Red Hat Enterprise Linux 10 and Red Hat OpenShift Container Platform 4.16 are advised to apply these official updates promptly via their respective update channels. Patch status is confirmed by Red Hat advisories linked in the references. No additional mitigations beyond applying the official fixes are specified.