CVE-2026-78322

A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.

Database specific

{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-120"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78322.json"
}

References

Affected packages

Git / gitlab.gnome.org/gnome/file-roller

Affected ranges

Type

GIT

Repo

https://gitlab.gnome.org/gnome/file-roller

Events

Introduced

Fixed

ffb76dc866342cef6a4914873faaa880d14d5aa4

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

3.*

3.0.1

3.0.2

3.1.1

3.1.2

3.1.90

3.1.91

3.1.92

3.10.0

3.10.1

3.11.1

3.11.2

3.11.3

3.11.4

3.11.5

3.11.90

3.11.91

3.11.92

3.12.0

3.12.1

3.13.1

3.13.2

3.13.91

3.13.92

3.14.0

3.14.1

3.15.1

3.15.2

3.15.90

3.15.91

3.15.92

3.16.0

3.16.1

3.16.2

3.16.3

3.16.4

3.19.1

3.19.90

3.19.91

3.2.0

3.2.1

3.20.0

3.20.1

3.20.2

3.21.90

3.21.91

3.22.0

3.22.1

3.22.2

3.22.3

3.23.91

3.23.92

3.24.0

3.24.1

3.25.1

3.25.91

3.26.0

3.26.1

3.27.1

3.27.90

3.27.91

3.28.0

3.29.1

3.29.90

3.29.91

3.3.1

3.3.2

3.3.3

3.3.90

3.3.91

3.3.92

3.30.0

3.30.1

3.31.1

3.31.2

3.31.90

3.31.91

3.31.92

3.32.0

3.32.1

3.32.2

3.35.1

3.35.90

3.35.91

3.35.92

3.36.0

3.36.1

3.36.2

3.37.90

3.38.0

3.39.1

3.4.0

3.4.1

3.4.2

3.40.0

3.41.90

3.42.0

3.5.1

3.5.2

3.5.3

3.5.4

3.5.90

3.5.91

3.5.92

3.6.0

3.6.1

3.6.1.1

3.6.2

3.7.1

3.7.2

3.7.3

3.7.90

3.7.91

3.7.92

3.8.0

3.8.1

3.9.1

3.9.2

3.9.3

3.9.4

3.9.90

3.9.91

3.9.92

43.*

43.0

43.alpha

Other

FILE_ROLLER_2_13_2

FILE_ROLLER_2_13_4

FILE_ROLLER_2_13_90

FILE_ROLLER_2_13_91

FILE_ROLLER_2_13_92

FILE_ROLLER_2_14_0

FILE_ROLLER_2_14_1

FILE_ROLLER_2_14_2

FILE_ROLLER_2_14_3

FILE_ROLLER_2_15_1

FILE_ROLLER_2_15_90

FILE_ROLLER_2_15_91

FILE_ROLLER_2_15_92

FILE_ROLLER_2_15_93

FILE_ROLLER_2_16_0

FILE_ROLLER_2_16_1

FILE_ROLLER_2_17_1

FILE_ROLLER_2_17_2

FILE_ROLLER_2_17_3

FILE_ROLLER_2_17_4

FILE_ROLLER_2_17_5

FILE_ROLLER_2_17_90

FILE_ROLLER_2_17_91

FILE_ROLLER_2_17_92

FILE_ROLLER_2_18_0

FILE_ROLLER_2_19_1

FILE_ROLLER_2_19_2

FILE_ROLLER_2_19_3

FILE_ROLLER_2_19_4

FILE_ROLLER_2_19_90

FILE_ROLLER_2_19_91

FILE_ROLLER_2_19_92

FILE_ROLLER_2_20_0

FILE_ROLLER_2_20_1

FILE_ROLLER_2_20_2

FILE_ROLLER_2_21_1

FILE_ROLLER_2_21_2

FILE_ROLLER_2_21_91

FILE_ROLLER_2_21_92

FILE_ROLLER_2_22_0

FILE_ROLLER_2_23_1

FILE_ROLLER_2_23_2

FILE_ROLLER_2_23_3

FILE_ROLLER_2_23_4

FILE_ROLLER_2_23_5

FILE_ROLLER_2_23_6

FILE_ROLLER_2_23_91

FILE_ROLLER_2_23_92

FILE_ROLLER_2_24_0

FILE_ROLLER_2_24_1

FILE_ROLLER_2_24_2

FILE_ROLLER_2_25_1

FILE_ROLLER_2_25_2

FILE_ROLLER_2_25_90

FILE_ROLLER_2_25_91

FILE_ROLLER_2_25_92

FILE_ROLLER_2_26_0

FILE_ROLLER_2_26_1

FILE_ROLLER_2_27_1

FILE_ROLLER_2_27_2

FILE_ROLLER_2_27_3

FILE_ROLLER_2_27_90

FILE_ROLLER_2_27_91

FILE_ROLLER_2_27_92

FILE_ROLLER_2_28_0

FILE_ROLLER_2_28_1

FILE_ROLLER_2_29_1

FILE_ROLLER_2_29_2

FILE_ROLLER_2_29_3

FILE_ROLLER_2_29_4

FILE_ROLLER_2_29_5

FILE_ROLLER_2_29_90

FILE_ROLLER_2_29_91

FILE_ROLLER_2_29_92

FILE_ROLLER_2_30_0

FILE_ROLLER_2_30_1

FILE_ROLLER_2_30_1_1

FILE_ROLLER_2_31_1

FILE_ROLLER_2_31_2

FILE_ROLLER_2_31_3

FILE_ROLLER_2_31_4

FILE_ROLLER_2_31_5

FILE_ROLLER_2_31_90

FILE_ROLLER_2_31_91

FILE_ROLLER_2_31_92

FILE_ROLLER_2_32_0

FILE_ROLLER_2_4_0_1

FILE_ROLLER_2_91_0

FILE_ROLLER_2_91_1

FILE_ROLLER_2_91_2

FILE_ROLLER_2_91_3

FILE_ROLLER_2_91_4

FILE_ROLLER_2_91_5

FILE_ROLLER_2_91_6

FILE_ROLLER_2_91_90

FILE_ROLLER_2_91_91

FILE_ROLLER_2_91_92

FILE_ROLLER_2_91_93

FILE_ROLLER_3_0_0

start

44.*

44.1

44.2

44.3

44.4

44.5

44.6

44.alpha

44.beta

Database specific

vanir_signatures_modified

"2026-08-28T08:05:19Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78322.json"

vanir_signatures

[
    {
        "deprecated": false,
        "target": {
            "file": "src/fr-command-7z.c"
        },
        "signature_type": "Line",
        "source": "https://gitlab.gnome.org/gnome/file-roller@ffb76dc866342cef6a4914873faaa880d14d5aa4",
        "digest": {
            "line_hashes": [
                "71739100515079171671998399096634081849",
                "44225993571777629518978982114950248584",
                "116814765018101274206339891031341346239",
                "66377892175672793800759435118149697766",
                "218835721609726306582542627341966370745",
                "159874825550173311683638355025478839445"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "id": "CVE-2026-78322-12c1fc5c"
    },
    {
        "deprecated": false,
        "target": {
            "function": "parse_progress_line",
            "file": "src/fr-command-7z.c"
        },
        "signature_version": "v1",
        "source": "https://gitlab.gnome.org/gnome/file-roller@ffb76dc866342cef6a4914873faaa880d14d5aa4",
        "digest": {
            "length": 440.0,
            "function_hash": "174967199003939698779035571221065610481"
        },
        "signature_type": "Function",
        "id": "CVE-2026-78322-3ff60830"
    },
    {
        "deprecated": false,
        "target": {
            "function": "parse_progress_line",
            "file": "src/fr-command-rar.c"
        },
        "signature_type": "Function",
        "source": "https://gitlab.gnome.org/gnome/file-roller@ffb76dc866342cef6a4914873faaa880d14d5aa4",
        "digest": {
            "length": 687.0,
            "function_hash": "179279891939609539761108533567531690102"
        },
        "signature_version": "v1",
        "id": "CVE-2026-78322-99b78b7a"
    },
    {
        "deprecated": false,
        "target": {
            "file": "src/fr-command-rar.c"
        },
        "signature_type": "Line",
        "source": "https://gitlab.gnome.org/gnome/file-roller@ffb76dc866342cef6a4914873faaa880d14d5aa4",
        "digest": {
            "line_hashes": [
                "92260839491535988139078718339886733309",
                "182539522940278318377020722814724026958",
                "64700519157211002289537761807881588040",
                "93482715441768267065952137702065150808",
                "233239623374405993071744805293670784223",
                "56051078724194283299607863466862266744",
                "59130114841488213729528654758529918807",
                "93086555017822165329417402925558998156"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "id": "CVE-2026-78322-ef3b564d"
    }
]