CVE-2026-16517
Summary
by MITRE • 07/22/2026
A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under examination represents a critical signed integer overflow condition within libarchive's ZIP writer implementation that manifests in the archive_write_zip_header function located in archive_write_set_format_zip.c. This flaw specifically emerges when ZIP encryption is actively enabled and file sizes approach the maximum value of int64_t, creating a scenario where arithmetic operations exceed the representable range of the signed integer type. The vulnerability falls under the CWE-190 category of Integer Overflow or Wraparound, which represents one of the most prevalent classes of security defects in software systems. The technical implementation involves a mathematical operation where encryption overhead is added to an entry size value that is already approaching the boundary conditions of int64_t, causing the result to wrap around to a negative value or otherwise produce an incorrect calculation.
The operational impact of this vulnerability extends beyond simple computational errors to potentially compromise system integrity through memory corruption and incorrect Zip64 extension decisions. When the integer overflow occurs during encryption overhead calculations, the ZIP writer may make erroneous determinations about whether to implement Zip64 extensions for file size handling, leading to malformed archive structures that could cause downstream applications to behave unpredictably or crash. The undefined behavior resulting from this overflow condition creates potential attack surfaces where malicious actors could exploit the incorrect data handling to perform memory corruption attacks or manipulate archive metadata in ways that compromise the security and reliability of the entire archive processing pipeline. This vulnerability directly relates to ATT&CK technique T1203, which involves exploitation of software vulnerabilities through manipulation of data structures and memory management.
The attack vector for this vulnerability requires an attacker to specifically craft ZIP archives with files near the INT64_MAX boundary while simultaneously enabling encryption, creating a precise combination of conditions that trigger the overflow. The consequence of successful exploitation could result in denial of service through application crashes or more severe memory corruption that might enable arbitrary code execution depending on the specific context where the corrupted data is processed. From a defensive perspective, this vulnerability demonstrates the critical importance of input validation and proper integer handling in archive processing libraries, particularly those handling encryption features that introduce additional computational overhead. The flaw underscores the necessity of comprehensive testing around boundary conditions and the implementation of robust overflow detection mechanisms within cryptographic and archival software components.
Mitigation strategies for this vulnerability should include immediate patching of affected libarchive versions and implementation of proper integer overflow checks before performing arithmetic operations involving file sizes and encryption overhead calculations. System administrators should consider implementing input validation measures that prevent files approaching maximum size limits from being processed through vulnerable systems, while also ensuring that all archive processing components are regularly updated to address known vulnerabilities. The fix should incorporate explicit bounds checking for int64_t operations and implement proper error handling when arithmetic overflow conditions are detected, preventing the propagation of incorrect values through the system. Additionally, organizations should conduct thorough vulnerability assessments of their archive processing workflows to identify other potential integer overflow conditions that could create similar security risks in their software environments.