CVE-2026-97370

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97370
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97370.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97370
Aliases
Published
2026-10-15T18:17:26Z
Modified
2026-10-16T02:47:51Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction
Details

Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-835"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97370.json"
}
References

Affected packages

Git / github.com/junrar/junrar

Affected ranges

Type
GIT
Repo
https://github.com/junrar/junrar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9fd65e3449274100f23dd6d9c592e7a12b788d36
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "7.6.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

junrar-0.*
junrar-0.6
junrar-0.7
junrar-1.*
junrar-1.0.0
junrar-2.*
junrar-2.0.0
junrar-3.*
junrar-3.0.0
junrar-3.1.0
junrar-3.1.1
junrar-4.*
junrar-4.0.0
v4.*
v4.0.0
v5.*
v5.0.0
v6.*
v6.0.0
v6.0.1
v7.*
v7.0.0
v7.1.0
v7.2.0
v7.3.0
v7.4.0
v7.4.1
v7.5.0
v7.5.1
v7.5.10
v7.5.2
v7.5.3
v7.5.4
v7.5.5
v7.5.6
v7.5.7
v7.5.8
v7.5.9
v7.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97370.json"