Ubuntu USN-8902-1: libarchive ZIP writer overflow on encrypted entries, CVE-2026-16517
Victoria Shinder2 min readCanonical published USN-8902-1 on 8 October for libarchive, the library behind archive reading and writing on Ubuntu. The notice covers one CVE, CVE-2026-16517, and three supported LTS releases.
What the bug is. According to the notice, libarchive's ZIP writer had a signed integer overflow when handling encrypted entries whose sizes are close to the maximum value. Canonical's assessment is that an attacker could possibly use it to make libarchive crash or execute arbitrary code; the overview line puts it as code running with the privileges of the user whose program opened a specially crafted file.
The detail worth noticing is the direction. Most archive bugs that reach a security notice live in the reader — the code that unpacks something a stranger sent. This one is in the writer, and it is triggered by entry sizes and encryption, which means the inputs that matter are whatever your software feeds into libarchive when it creates ZIP files. Services that build encrypted ZIP downloads from user-supplied files, backup jobs and export features are the places to think about, not only the desktop archive manager.
Fixed package versions:
- Ubuntu 26.04 LTS (resolute):
libarchive13t643.8.5-1ubuntu2.3 - Ubuntu 24.04 LTS (noble):
libarchive13t643.7.2-2ubuntu0.9 - Ubuntu 22.04 LTS (jammy):
libarchive133.6.0-1ubuntu1.9
Canonical's instruction is the usual one: a standard system update makes all necessary changes. Because libarchive is a shared library, the update only protects processes started after it is installed — long-running services that link it should be restarted.
What the notice does not say. It gives no CVSS score, no upstream libarchive version and no description of exploitation in the wild. Those details belong to the CVE record and to the libarchive project, not to this notice, and they are not claimed here.
Source: Ubuntu Security Notice USN-8902-1, libarchive vulnerability, 8 October 2026 — https://ubuntu.com/security/notices/USN-8902-1