rootpwn

high · CVSS v3 7.5

CVE-2026-97370

CVE-2026-97370 affects the open‑source Junrar Java library, allowing a crafted RAR4 archive to trigger an infinite CPU loop during extractio

Overview

CVE-2026-97370 affects the open‑source Junrar Java library, allowing a crafted RAR4 archive to trigger an infinite CPU loop during extraction. The flaw resides in the RarVM.ExecuteCode routine, which can jump beyond the program’s code size without proper bounds checking. This results in a denial‑of‑service condition that can exhaust worker threads and degrade service availability.

Description

Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1.

Impact

Defenders using Junrar for archive extraction may experience prolonged CPU usage and thread exhaustion, leading to service slowdown or unresponsiveness. The vulnerability does not enable code execution or data disclosure, but it can disrupt availability for applications that rely on Junrar. Monitoring CPU and thread metrics is essential to detect exploitation attempts.

Remediation

Upgrade Junrar to version 7.6.1 or later, where the RarVM bounds check is fixed. As an additional safeguard, configure worker thread pools with timeouts or CPU limits, and monitor for abnormal CPU spikes during archive processing. If upgrade is not immediately possible, consider sandboxing extraction or using alternative libraries.

Risk context

The CVSS v3 score of 7.5 and high severity indicate a significant risk, though no EPSS data is available. Defenders should treat this as a high‑priority issue and apply the patch promptly to avoid potential availability disruptions.

Affected products

  • Junrar

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

availability denial-of-service Java archive junrar high-severity resource-exhaustion

← All CVEs

Related CVEs

high

CVE-2026-96537

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

View analysis

high

CVE-2026-102986

Plane, an open-source project management tool, has a flaw in its public asset endpoint that allows authenticated users to create or delete assets in any project if they know the anchor. This can lead to unauthorized file injection, storage abuse, and data loss across workspaces. The vulnerability is present in versions 1.3.1 and earlier.

View analysis

high

CVE-2026-108448

A heap-based buffer overflow in Microsoft Outlook can be triggered by an attacker over the network, enabling remote code execution. The flaw exists in the handling of certain message types or attachments. It allows attackers to run arbitrary code on the victim's machine without authentication.

View analysis

high

CVE-2026-108453

An out-of-bounds read vulnerability in Microsoft PowerPoint can allow an unauthorized attacker to read sensitive data over a network. The flaw exists in the handling of certain presentation files and can be triggered without user interaction. It enables information disclosure to remote adversaries.

View analysis