CVE-2026-97370

Deferred Deferred - Pending Action

Infinite Loop in Junrar RAR Archive Extraction

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-97370

EUVD

EUVD-2026-102251

Affected Vendors & Products

Vendor	Product	Version / Range
junrar	junrar	< 7.6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability affects the junrar library, specifically versions 7.6.0 and earlier. It allows a crafted RAR4 archive to trigger an infinite CPU loop during extraction by exploiting a flaw in the RarVM's setIP() function. The function fails to properly bound the virtual machine's instruction pointer when handling jump instructions like VM_JMP, causing the loop counter to remain unchanged and leading to endless execution of the same instruction.

Detection Guidance

Monitor CPU usage spikes during RAR extraction tasks. Check for processes stuck in infinite loops using system tools like top, htop, or ps. Inspect junrar library versions in use; versions 7.6.0 and earlier are vulnerable.

Impact Analysis

Any application using junrar to extract untrusted RAR archives may experience a denial of service. The extraction thread consumes excessive CPU resources and blocks the process. The vulnerability does not enable remote code execution or privilege escalation but poses a significant availability risk, particularly in services processing user-uploaded archives.

Compliance Impact

This vulnerability primarily impacts availability by causing denial-of-service conditions through infinite CPU loops during archive extraction. It does not directly affect data confidentiality or integrity, so its impact on GDPR or HIPAA compliance is indirect. However, prolonged unavailability of systems processing RAR archives could lead to violations of service-level agreements or operational disruptions that may conflict with regulatory requirements for data accessibility and timely processing.

Mitigation Strategies

Upgrade junrar to version 7.6.1 or later. If upgrading is not possible, restrict access to systems processing untrusted RAR archives or disable RAR extraction features until patched.

Hi! I’m here to help you understand CVE-2026-97370. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70