ANT-2026-R8N72JR9 · libarchive/libarchive

heap-buffer-overflow medium

Severity Claude medium · Security research firm medium · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-R8N72JR9: Off-by-one heap buffer overflow in ISO 9660 Joliet build_pathname_utf16be() path separator write

An off-by-one error in build_pathname_utf16be() causes a heap buffer overflow when writing the UTF-16BE path separator for ISO 9660 Joliet entries.

Target

Project: libarchive
Location: build_pathname_utf16be()
Discovery: static analysis — not yet dynamically reproduced

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. A trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-R8N72JR9.

Reference: ANT-2026-R8N72JR9
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits.

Verdict
true positive
Severity
medium
UPSTREAM FIX

The change that resolved this finding.

diff --git a/libarchive/archive_read_support_format_iso9660.c b/libarchive/archive_read_support_format_iso9660.c
index c69fcd272b..e3b57869f9 100644
--- a/libarchive/archive_read_support_format_iso9660.c
+++ b/libarchive/archive_read_support_format_iso9660.c
@@ -3493,6 +3493,8 @@ build_pathname_utf16be(unsigned char *p, size_t max, size_t *len,
 	if (file->parent != NULL && file->parent->utf16be_bytes > 0) {
 		if (build_pathname_utf16be(p, max, len, file->parent) != 0)
 			return (-1);
+		if (*len + 2 > max)
+			return (-1);/* Path is too long! */
 		p[*len] = 0;
 		p[*len + 1] = '/';
 		*len += 2;

https://github.com/libarchive/libarchive/commit/750e8d7b25deeb67a976ab0c9f482ec1d2ac68a4

TIMELINE

Dates from discovery through public reveal.

  1. 2026-03-29 Reported to tracker
  2. 2026-04-09 Sent to maintainer
  3. 2026-05-01 Patch released
  4. 2026-05-09 Maintainer acknowledged
  5. 2026-08-17 Publicly revealed
PROVENANCE

SHA-3-512 hash:

b755517858ccdf6bcb3ec3f190c687fe5832ac7811f6d35d7359d899b61cc487d9fdafdf4dfc3b683f7403d23d681ee9ad5f61768cc1426b088851856b241536

Committed 2026-04-09 11:49 PT

Revealed 2026-08-17 13:03 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-R8N72JR9",
  "bug_class": "Heap Buffer Overflow",
  "claude_severity": "medium",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:04+00:00",
  "description": "An off-by-one error in build_pathname_utf16be() causes a heap buffer overflow when writing the UTF-16BE path separator for ISO 9660 Joliet entries.",
  "discovered_at": null,
  "location": "build_pathname_utf16be()",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "libarchive",
  "reproduction": null,
  "technical_details": null,
  "title": "Off-by-one heap buffer overflow in ISO 9660 Joliet build_pathname_utf16be() path separator write",
  "vendor_severity": "medium"
}