SB2026111323 - Multiple vulnerabilities in sharpcompress

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111323

SB2026111323 - Multiple vulnerabilities in sharpcompress

Published: November 13, 2026

Security Bulletin ID SB2026111323
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 83% Low 17%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Uncontrolled Memory Allocation (CVE-ID: N/A)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.

The vulnerability exists due to excessive memory allocation in SharpCompress's RAR5 UnpackV2017.Init when processing an attacker-controlled dictionary/window size without an effective bound before decoding entry data. A remote attacker can induce a victim to extract or read an entry from a crafted 72-byte RAR5 archive with zero compressed bytes to trigger a 1 GiB window allocation and exhaust process memory.


2) Uncontrolled Memory Allocation (CVE-ID: N/A)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.

The vulnerability exists due to memory allocation with excessive size values in the SharpCompress 7z reader when processing unbounded nested header counts, coder-properties sizes, and encoded-header uncompressed sizes before validating corresponding data. A remote attacker can trick a victim into opening or enumerating a tiny, CRC-valid 7z archive containing oversized values to trigger disproportionately large allocations and exhaust process memory.


3) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through CPU exhaustion and unbounded memory growth.

The vulnerability exists due to missing negative entry-size validation in SharpCompress's seekable TAR parser when enumerating or extracting archive entries, allowing stream rewinding and an infinite loop that retains fabricated entries. A remote attacker can supply a 512-byte TAR with a signed base-256 entry size of -512 to trigger non-terminating enumeration through archive.Entries or WriteToDirectory and exhaust resources.


4) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by indefinitely consuming a CPU core and stalling archive processing.

The vulnerability exists due to a loop with an unreachable exit condition in SharpCompress's CBZip2InputStream decoder when processing corrupted BZip2-compressed ZIP entries through ReaderFactory, because ReadByte() can repeatedly return a byte without advancing decoder state or signaling stream termination. A remote attacker can supply a ZIP archive containing a single-byte corruption in a BZip2 entry to trigger the infinite loop during entry reading or disposal.


5) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to create ZIP archives with duplicate entry names that may obscure archive contents depending on the extracting application.

The vulnerability exists due to incomplete duplicate-key validation in SharpCompress archive-writing APIs when adding entries: synchronous checks examine only the first existing entry, while asynchronous checks do not reflect newly added entries. A remote attacker can supply names such as file1.txt and FILE1.TXT after an unrelated entry synchronously, or directly asynchronously, to bypass duplicate rejection and produce ambiguous archives.


6) Use of uninitialized resource (CVE-ID: N/A)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to potentially disclose sensitive process memory and cause malformed compressed data to be accepted.

The vulnerability exists due to missing back-reference distance validation and use of uncleared pooled memory in SharpCompress's Deflate decoder when decompressing invalid streams. A remote attacker can supply a stream containing literal A followed by length 3 / distance 4 to copy previously stored window bytes into decompressed output and potentially expose unrelated data.


Remediation

Install update from vendor's website.

References