CVE-2026-78322 File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers
A stack buffer overflow in file-roller allows attackers to cause a denial of service by tricking users into opening malicious archives.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-78322?
CVE-2026-78322 is a medium-severity memory corruption vulnerability in Red Hat Enterprise Linux 6, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.
Weakness: CWE-120
Which versions are affected by CVE-2026-78322?
Linux distribution packages (3)
file-roller SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 43.1-150600.3.3.1 |
file-roller SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.20.3-15.12.1 |
file-roller openSUSE:Leap 16.0 | All versions | 44.5-bp160.2.1 |
How do I fix CVE-2026-78322?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-78322 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-78322 exists.
Sources
Also known as DEBIAN-CVE-2026-78322, GHSA-qgv9-pfrp-f7x5, OESA-2026-3803, OESA-2026-3804, OESA-2026-3805, OESA-2026-3806 and 5 more.