CVE-2026-78322: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Red Hat Red Hat Enterprise Linux 6
CVE-2026-78322 is a stack buffer overflow vulnerability in file-roller on Red Hat Enterprise Linux 6. It occurs when opening or extracting malicious 7z or RAR archives containing file entries with excessively long paths. The flaw causes file-roller to copy the path into a fixed-size stack buffer without proper bounds checking, leading to a crash and denial of service. Exploitation requires user interaction and is unlikely to allow arbitrary code execution on hardened systems.
AI Analysis
Technical Summary
This vulnerability in file-roller arises from unbounded string copying of file paths during progress-line parsing when handling 7z or RAR archives with excessively long file paths. The fixed-size stack buffer overflow results in application termination, causing denial of service. The vulnerability requires a victim to open or extract a crafted archive using file-roller. While buffer overflows can sometimes lead to code execution, Red Hat notes that arbitrary code execution is difficult on hardened systems. The CVSS v3.1 score is 6.5 (medium severity) with no confidentiality or integrity impact but high availability impact.
Potential Impact
Successful exploitation causes file-roller to crash, resulting in denial of service. There is no impact on confidentiality or integrity. Arbitrary code execution is considered difficult to achieve on hardened Red Hat systems. The vulnerability requires user interaction to open or extract a malicious archive.
Mitigation Recommendations
Red Hat advises avoiding opening or extracting untrusted 7z or RAR archives with file-roller until an updated package is installed. Patch status is not confirmed in the advisory; users should monitor the Red Hat advisory page for updates and apply fixes when available.
CVE-2026-78322: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Red Hat Red Hat Enterprise Linux 6
Description
CVE-2026-78322 is a stack buffer overflow vulnerability in file-roller on Red Hat Enterprise Linux 6. It occurs when opening or extracting malicious 7z or RAR archives containing file entries with excessively long paths. The flaw causes file-roller to copy the path into a fixed-size stack buffer without proper bounds checking, leading to a crash and denial of service. Exploitation requires user interaction and is unlikely to allow arbitrary code execution on hardened systems.
CVSS v3.1
Score 6.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in file-roller arises from unbounded string copying of file paths during progress-line parsing when handling 7z or RAR archives with excessively long file paths. The fixed-size stack buffer overflow results in application termination, causing denial of service. The vulnerability requires a victim to open or extract a crafted archive using file-roller. While buffer overflows can sometimes lead to code execution, Red Hat notes that arbitrary code execution is difficult on hardened systems. The CVSS v3.1 score is 6.5 (medium severity) with no confidentiality or integrity impact but high availability impact.
Potential Impact
Successful exploitation causes file-roller to crash, resulting in denial of service. There is no impact on confidentiality or integrity. Arbitrary code execution is considered difficult to achieve on hardened Red Hat systems. The vulnerability requires user interaction to open or extract a malicious archive.
Mitigation Recommendations
Red Hat advises avoiding opening or extracting untrusted 7z or RAR archives with file-roller until an updated package is installed. Patch status is not confirmed in the advisory; users should monitor the Red Hat advisory page for updates and apply fixes when available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-08-24T08:53:42.508Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-78322","vendor":"Red Hat"}]
Threat ID: 6a8d4643acd9273b49da63af
Added to database: 08/25/2026, 07:37:39 UTC
Last enriched: 08/25/2026, 07:52:16 UTC
Last updated: 08/25/2026, 07:52:16 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.