CVE-2022-26280: fedoraproject fedora Out-of-bounds Read
CVSS: 6.5v3.1MediumModified
AliasesALPINE-CVE-2022-26280MGASA-2022-0142SUSE-SU-2022:1803-1RHSA-2022:5252UBUNTU-CVE-2022-26280USN-5374-1DEBIAN-CVE-2022-26280
Published 28-03-2022Last modified 03-11-2025
Vulnerability summary
CVE-2022-26280 is a medium (CVSS 6.5) Out-of-bounds Read vulnerability in fedoraproject fedora. EPSS estimates a 1.88% chance of exploitation in the next 30 days, higher than 79.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
1.88%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 3 · Duplicates 1 · Related 2Timeline
- 28-03-2022PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:N/A:PSourcesSingle source
EPSS trend
Probability
1.88%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.88% on 20-09-2026
20-09-202620-10-2026
EPSS score1.88%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLibarchive
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Redhat8 products
- bsdcat-debuginfo< 0:3.5.3-2.el9_0
- bsdcpio-debuginfo< 0:3.5.3-2.el9_0
- bsdtar< 0:3.5.3-2.el9_0
- bsdtar-debuginfo< 0:3.5.3-2.el9_0
- libarchive< 0:3.5.3-2.el9_0
Suse2 products
- libarchive&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 3.4.2-150200.4.6.1
- libarchive&distro=SUSE Linux Enterprise Module for Development Tools 15 SP3< 3.4.2-150200.4.6.1
Alpine1 product
- libarchive< 3.6.1-r0
Debian1 product
- libarchive< 3.6.2-1
Fedoraproject1 product
- fedoraEOL36
Libarchive1 product
- libarchive3.6.0
Mageia1 product
- libarchive< 3.6.1-1.mga8
Opensuse1 product
- libarchive&distro=openSUSE Leap 15.3< 3.4.2-150200.4.6.1
Ubuntu1 product
- libarchive< 3.6.0-1ubuntu1 | < 3.4.0-2ubuntu1.2
9 vendors · 17 products
References
21 links- github.com/libarchive/libarchive/issues/1672X Refsource MISCREPORTExploitIssue TrackingThird Party Advisory
