Debian 11 libarchive Critical DoS & Remote Exploits DLA-4563-1

CVE-2026-4111

A flaw was identified in the RAR5 archive decompression logic of the
libarchive library, specifically within the archive_read_data()
processing path. When a specially crafted RAR5 archive is processed,
the decompression routine may enter a state where internal logic
prevents forward progress. This condition results in an infinite loop
that continuously consumes CPU resources. Because the archive passes
checksum validation and appears structurally valid, affected
applications cannot detect the issue before processing. This can allow
attackers to cause persistent denial-of-service conditions in services
that automatically process archives.

CVE-2026-4424

A flaw was found in libarchive. This heap out-of-bounds read
vulnerability exists in the RAR archive processing logic due to
improper validation of the LZSS sliding window size after transitions
between compression methods. A remote attacker can exploit this by