What’s Vulnerable › Vulnerabilities

CVE-2024-26256: Libarchive Remote Code Execution Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 87.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-09 · updated 2026-06-17
• Weakness: CWE-122

Description

Libarchive Remote Code Execution Vulnerability

Affected products

• Fedoraproject Fedora: 39, 40
• libarchive: before 3.7.4 — fixed in 3.7.4
• Microsoft Windows 11: before 10.0.22621.3447 — fixed in 10.0.22621.3447
• Microsoft Windows 11: before 10.0.22631.3447 — fixed in 10.0.22631.3447
• Microsoft Windows Server 2022, 23H2 Edition (Server Core installation): before 10.0.25398.830 — fixed in 10.0.25398.830
• Microsoft Windows 11: from 10.0.22621.0 before 10.0.22621.3447 — fixed in 10.0.22621.3447
• Microsoft Windows 11 version 22H3: from 10.0.22631.0 before 10.0.22631.3447 — fixed in 10.0.22631.3447
• Microsoft Windows 11: from 10.0.22631.0 before 10.0.22631.3447 — fixed in 10.0.22631.3447
• Microsoft Windows Server 2022, 23H2 Edition (Server Core installation): from 10.0.25398.0 before 10.0.25398.830 — fixed in 10.0.25398.830

How to fix

Upgrade to a fixed version: libarchive 3.7.4; Microsoft Windows 11 10.0.22621.3447; Microsoft Windows 11 10.0.22631.3447; Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.830; Microsoft Windows 11 10.0.22621.3447; Microsoft Windows 11 version 22H3 10.0.22631.3447; Microsoft Windows 11 10.0.22631.3447; Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.830. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26256
• http://www.openwall.com/lists/oss-security/2024/06/04/2
• http://www.openwall.com/lists/oss-security/2024/06/05/1
• https://github.com/LeSuisse/nixpkgs/commit/81b82a2934521dffef76f7ca305d8d4e22fe7262
• https://github.com/libarchive/libarchive/commit/eb7939b24a681a04648a59cdebd386b1e9dc9237.patch
• https://github.com/libarchive/libarchive/releases/tag/v3.7.4
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EWANFZ6NEMXFCALXWI2AFKYBOLONAVFC/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TWAMR5TY47UKVYMWQXB34CWSBNTRYMBV/
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26256
• https://www.openwall.com/lists/oss-security/2024/06/04/2

Get alerted when CVE-2024-26256 or the next vulnerability affects your stack