CVE-2022-26280 Memory corruption in n/a

Medium 6.5 Published 28 Mar 2022 Updated 3 Nov 2025

An out-of-bounds read in Libarchive's zipx_lzma_alone_init component allows attackers to cause denial of service or disclose sensitive memory contents.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-26280?

CVE-2022-26280 is a medium-severity memory corruption vulnerability in Fedoraproject Fedora, published on 28 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.

Weakness: CWE-125

Which versions are affected by CVE-2022-26280?

It affects 2 products.

Linux distribution packages (25)

`bsdtar` AlmaLinux:9	All versions	`3.5.3-2.el9_0`
`libarchive` AlmaLinux:9	All versions	`3.5.3-2.el9_0`
`libarchive-devel` AlmaLinux:9	All versions	`3.5.3-2.el9_0`
`bsdcat-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:3.5.3-2.el9_0`
`bsdcpio-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:3.5.3-2.el9_0`
`bsdtar` Red Hat:enterprise_linux:9::appstream	All versions	`0:3.5.3-2.el9_0`
`bsdtar-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:3.5.3-2.el9_0`
`libarchive-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:3.5.3-2.el9_0`
`libarchive-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:3.5.3-2.el9_0`
`bsdcat-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:3.5.3-2.el9_0`
`bsdcpio-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:3.5.3-2.el9_0`
`bsdtar-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:3.5.3-2.el9_0`
`libarchive` Red Hat:enterprise_linux:9::baseos	All versions	`0:3.5.3-2.el9_0`
`libarchive-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:3.5.3-2.el9_0`
`libarchive-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:3.5.3-2.el9_0`
`bsdcat-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`0:3.5.3-2.el9_0`
`bsdcpio-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`0:3.5.3-2.el9_0`
`bsdtar-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`0:3.5.3-2.el9_0`
`libarchive-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`0:3.5.3-2.el9_0`
`libarchive-debugsource` Red Hat:enterprise_linux:9::crb	All versions	`0:3.5.3-2.el9_0`
`libarchive-devel` Red Hat:enterprise_linux:9::crb	All versions	`0:3.5.3-2.el9_0`
`libarchive` Rocky Linux:9	All versions	`0:3.5.3-2.el9_0`
`libarchive` SUSE:Linux Enterprise Module for Basesystem 15 SP3	All versions	`3.4.2-150200.4.6.1`
`libarchive` SUSE:Linux Enterprise Module for Development Tools 15 SP3	All versions	`3.4.2-150200.4.6.1`
`libarchive` openSUSE:Leap 15.3	All versions	`3.4.2-150200.4.6.1`

Products include Fedoraproject Fedora, Libarchive Libarchive.

How do I fix CVE-2022-26280?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-26280 being exploited?

There is no known exploitation of CVE-2022-26280 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALPINE-CVE-2022-26280, ALSA-2022:5252, AZL-9210, CVE-2022-28066, DEBIAN-CVE-2022-26280, GHSA-v37p-j5qh-w8c9 and 7 more.