CVE-2026-16517 is a signed integer overflow vulnerability in the archive_write_zip_header function of libarchive's ZIP writer component. When ZIP encryption is enabled and the entry file size is near INT64_MAX, adding encryption overhead causes an int64_t overflow, leading to undefined behavior. This may result in incorrect Zip64 extension decisions or memory corruption. Red Hat rates this issue as low severity because it affects only the ZIP write path under very specific conditions that are unlikely to occur in practice. The vulnerability is addressed in updated libarchive RPMs for Red Hat Hardened Images.

The vulnerability can cause undefined behavior including potential memory corruption or application crashes when processing ZIP archives with encryption enabled and extremely large file sizes near INT64_MAX. However, the conditions required are highly contrived, making practical exploitation unlikely. The impact is limited to availability (possible crashes) with no confidentiality or integrity loss expected under normal circumstances.

Red Hat has released updated RPM packages for libarchive as part of the Red Hat Hardened Images security update that address CVE-2026-16517. Users should apply these updates to mitigate the vulnerability. Since the vulnerability requires ZIP encryption enabled and extremely large file sizes, if these conditions are not met, the risk is minimal. No additional mitigations are specified by Red Hat.