CVE-2024-26256

Deeper analysis

CVE-2024-26256 is a remote code execution vulnerability in libarchive, the open-source archiving library used by multiple operating systems and applications for handling formats such as tar, cpio, and zip. The flaw is tracked under CWE-122 and CWE-787, indicating a heap-based buffer overflow that leads to an out-of-bounds write, and carries a CVSS 3.1 score of 7.8 reflecting local attack vector, low complexity, and no required privileges.

An attacker can exploit the issue by supplying a specially crafted archive file that a victim opens or extracts on a vulnerable system. Successful exploitation grants the ability to execute arbitrary code with the privileges of the affected process, resulting in full confidentiality, integrity, and availability impact on the local machine.

Microsoft Security Response Center and libarchive project advisories point to patched releases that address the buffer handling errors; the referenced commits in the libarchive repository and downstream packaging fixes, such as those in nixpkgs, provide the concrete code changes for remediation.

EPSS for the vulnerability rose from a low baseline to a peak of 0.5160 on 2025-12-11 before receding to the current value of 0.3769, indicating a period of increased exploitation interest after disclosure.