CVE Intelligence
Analysis AI-assisted

CVE-2026-24857: Simsong bulk_extractor RAR Decoder Heap Buffer Overflow

CVE-2026-24857 is a heap buffer overflow in the embedded unrar code of Simsong bulk_extractor, starting with version 1.4. A crafted RAR archive inside a disk image can trigger an out-of-bounds write, and the record notes potential for remote code execution. The record reports no known patch at publication, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The Simsong bulk_extractor digital forensics tool embeds a copy of unrar code. According to the record, a heap-buffer-overflow in the RAR PPM LZ decoding path can be reached through a crafted RAR archive inside a disk image, causing an out-of-bounds write in Unpack::CopyString. The record classifies the weakness as CWE-787 (Out-of-bounds Write).

Impact

  • The record reports an ASAN crash and states that production builds would likely crash or suffer memory corruption.
  • The record notes potential for remote code execution. NVD scores the issue 9.8 under CVSS 3.1, with network attack vector, low complexity, no privileges and no user interaction required.
  • GitHub as CNA scored the issue 5.5 under CVSS 4.0.

Affected products and versions

  • Simsong Bulk Extractor, starting with version 1.4, according to the record.
  • The record lists no upper bound and no fixed version.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.
  • A reference is tagged 'Exploit' in the record metadata. That tag alone does not confirm exploitation in the wild.

Remediation and mitigation

  • The record states that no known patches were available at publication. Check the GitHub advisory for later updates.
  • Until a fix is confirmed, avoid processing RAR content from untrusted or unknown disk images with affected versions.
  • Run forensic analysis in isolated, disposable environments with limited privileges and restricted network access.
  • Keep analysis workstations segregated from sensitive networks and credentials.

Detection guidance

  • Monitor analysis hosts for unexpected crashes or restarts of bulk_extractor.
  • Record the source of disk images and archives submitted for examination, so suspicious inputs can be traced.
  • Review analysis workstations for unexpected child processes or file writes during extraction jobs.

Limitations of the available information

  • The record contains no fixed version, patch or vendor-confirmed remediation.
  • The record describes RCE only as potential. It does not demonstrate exploitability beyond the ASAN crash.
  • No EPSS or SSVC data is present in the record.

Frequently asked questions

Which versions of bulk_extractor are affected by CVE-2026-24857?

The record lists Simsong Bulk Extractor starting with version 1.4. It gives no upper bound and no fixed version.

Is CVE-2026-24857 known to be actively exploited?

The record shows the CVE is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The 'Exploit' tag on a reference does not confirm exploitation in the wild.

What can administrators do while no patch is listed?

Avoid processing RAR content from untrusted disk images, run analysis in isolated and least-privilege environments, and monitor the GitHub advisory for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.