CVE-2026-24857: bulk_extractor has Heap-based Buffer Overflow vulnerability

Vulnerability summary

CVE-2026-24857 is a critical (CVSS 9.8) Heap-based Buffer Overflow vulnerability in simsong bulk_extractor. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 28-01-2026
   PublishedVulnerability first disclosed.
2. 29-01-2026
   Last modifiedVulnerability information updated.

Description

`bulk_extractor` is a digital forensics exploitation tool. Starting in version 1.4, `bulk_extractor`’s embedded unrar code has a heap‑buffer‑overflow in the RAR PPM LZ decoding path. A crafted RAR inside a disk image causes an out‑of‑bounds write in `Unpack::CopyString`, leading to a crash under ASAN (and likely a crash or memory corruption in production builds). There's potential for using this for RCE. As of time of publication, no known patches are available.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.