SB2026110975 - Infinite loop in sharpcompress

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110975

SB2026110975 - Infinite loop in sharpcompress

Published: November 9, 2026

Security Bulletin ID SB2026110975
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to deny service to applications that automatically decompress untrusted archives with SharpCompress.

The vulnerability exists due to improper end-of-stream handling in the LZMA2 decoder when truncated XZ streams or crafted 7z archives end at a chunk boundary before the next control byte. An unauthenticated remote attacker can submit these inputs concurrently to trigger infinite decoding loops that exhaust CPU cores and make the application unavailable.


Remediation

Install update from vendor's website.

References