CVE-2026-16517 Libarchive: libarchive: signed integer overflow in archive_write_zip_header
Signed integer overflow in Libarchive's ZIP writer when encryption is enabled may cause memory corruption or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-16517?
CVE-2026-16517 is a low-severity vulnerability in Red Hat Enterprise Linux 10, published on 21 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.
Weakness: CWE-190
Which versions are affected by CVE-2026-16517?
How do I fix CVE-2026-16517?
Apply the vendor's patch.
Is CVE-2026-16517 being exploited?
There is no known exploitation of CVE-2026-16517 in the wild and no public exploit code.
Sources
Also known as AZL-93231, BELL-CVE-2026-16517, DEBIAN-CVE-2026-16517, ECHO-af27-3cf7-5f51, GHSA-j8w5-8rj6-wpwf, OESA-2026-3258 and 2 more.