CVE-2026-78322
Received Received - Intake

Stack Buffer Overflow in File-Roller via Malicious Archive

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: redhat-SADP

Description
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-78322
EUVD
EUVD-2026-65311

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnome file-roller 44.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78322 is a stack-based buffer overflow in file-roller, a GNOME file archiver utility. When processing 7z or RAR archives with excessively long file paths, the application copies these paths into fixed-size stack buffers without length validation. This causes a buffer overflow, potentially crashing file-roller and leading to denial of service.

Detection Guidance

To detect this vulnerability, monitor file-roller for crashes when opening or extracting 7z or RAR archives. Check for unusually long file paths in archives using commands like 'unzip -l archive.7z' or 'unrar l archive.rar'. Look for stack overflow errors in system logs after processing such archives.

Impact Analysis

If you open or extract a malicious 7z or RAR archive with a very long file path, file-roller may crash, causing a denial of service. While code execution is difficult on modern systems with protections like stack canaries, the crash itself disrupts normal file operations.

Mitigation Strategies

Avoid opening or extracting untrusted 7z or RAR archives until file-roller is updated. Update file-roller to version 44.7 or later. If immediate update is not possible, disable file-roller's handling of 7z and RAR archives by removing their MIME types or using alternative archiving tools.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78322. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart