CVE-2026-4111

A flaw has been identified in the RAR5 archive decompression logic of the libarchive library, specifically in the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state that prevents forward progress. This condition results in an infinite loop, continuously consuming CPU resources. Since the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue prior to processing. This vulnerability can enable attackers to create persistent denial-of-service conditions in services that automatically process archives.

‍