CVE-2024-48957

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-10 · updated 2026-06-17
Weakness: CWE-125

Description

execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.

Affected products

libarchive: from 3.6.0 before 3.7.5 — fixed in 3.7.5

How to fix

Upgrade to a fixed version: libarchive 3.7.5. Check the vendor advisory for mitigations.

References

https://github.com/libarchive/libarchive/compare/v3.7.4...v3.7.5
https://github.com/libarchive/libarchive/pull/2149
https://github.com/terrynini/CVE-Reports/blob/main/CVE-2024-48957/README.md

Get alerted when CVE-2024-48957 or the next vulnerability affects your stack