Libarchive: libarchive: signed integer overflow in archive_write_zip_header
CVE-2026-16517 is fixed in 6 products on 1 platform, first by RHSA-2026:69553, released July 8, 2026. It is not reported as exploited. Patch Radar priority: Routine.
A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| bsdtar · almalinux 10 | 3.7.7-11.el10_2 | ALSA-2026:69553 | Sep 21, 2026 |
| bsdtar · ol 10 | 0:3.7.7-11.el10_2 | ELSA-2026-69553 | Sep 23, 2026 |
| libarchive · Debian 12.15 (bookworm) | 3.6.2-1+deb12u5 | DEBIAN-CVE-2026-16517 | Aug 7, 2026 |
| libarchive · Debian 14 | 3.8.9-1 | DEBIAN-CVE-2026-16517 | Aug 7, 2026 |
| libarchive · RHEL 10 | 3.7.7-11.el10_2 | RHSA-2026:69553 | Jul 8, 2026 |
| libarchive · almalinux 10 | 3.7.7-11.el10_2 | ALSA-2026:69553 | Sep 21, 2026 |
| libarchive · ol 10 | 0:3.7.7-11.el10_2 | ELSA-2026-69553 | Sep 23, 2026 |
| libarchive · rocky 10 | 0:3.7.7-11.el10_2 | RLSA-2026:69553 | Sep 23, 2026 |
| libarchive-devel · almalinux 10 | 3.7.7-11.el10_2 | ALSA-2026:69553 | Sep 21, 2026 |
| libarchive-devel · ol 10 | 0:3.7.7-11.el10_2 | ELSA-2026-69553 | Sep 23, 2026 |
| libarchive-tools · Ubuntu 22.04.1 LTS (jammy) | 3.6.0-1ubuntu1.9 | libarchive-tools 3.6.0-1ubuntu1.9 | Jul 21, 2026 |
| libarchive-tools · Ubuntu 24.04.5 LTS (noble) | 3.7.2-2ubuntu0.9 | libarchive-tools 3.7.2-2ubuntu0.9 | Jul 21, 2026 |
| libarchive-tools · Ubuntu 26.04.1 LTS (resolute) | 3.8.5-1ubuntu2.3 | libarchive-tools 3.8.5-1ubuntu2.3 | Jul 21, 2026 |
| libarchive13 · Ubuntu 22.04.1 LTS (jammy) | 3.6.0-1ubuntu1.9 | libarchive13 3.6.0-1ubuntu1.9 | Jul 21, 2026 |
| libarchive13t64 · Ubuntu 24.04.5 LTS (noble) | 3.7.2-2ubuntu0.9 | libarchive13t64 3.7.2-2ubuntu0.9 | Jul 21, 2026 |
| libarchive13t64 · Ubuntu 26.04.1 LTS (resolute) | 3.8.5-1ubuntu2.3 | libarchive13t64 3.8.5-1ubuntu2.3 | Jul 21, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.