CVE-2016-10209 Null dereference in n/a

What is CVE-2016-10209?

CVE-2016-10209 is a medium-severity vulnerability in Libarchive Libarchive, published on 3 Apr 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file.

Weakness: CWE-476

Which versions are affected by CVE-2016-10209?

It affects 1 product.

Products include Libarchive Libarchive.

How do I fix CVE-2016-10209?

Upgrade to a fixed version.

Is CVE-2016-10209 being exploited?

There is no known exploitation of CVE-2016-10209 in the wild and no public exploit code.

Other vulnerabilities in Libarchive Libarchive

• CVE-2024-37407 Memory corruption in n/a Critical 9.1
• CVE-2016-1541 Memory corruption in n/a High 8.8
• CVE-2016-6250 Integer overflow in n/a High 8.6
• CVE-2025-5914 Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c High 7.8
• CVE-2024-48957 Memory corruption in n/a High 7.8

All Libarchive Libarchive vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CVE-2016-1000349, DEBIAN-CVE-2016-10209, GHSA-jq66-w858-f282, UBUNTU-CVE-2016-10209.