Vulnerability details

CVE-2026-97370

junrar junrar

Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

CVSS 3.1

7.5High

Official description

Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
junrar	junrar	< 7.6.1	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/junrar/junrar/security/advisories/GHSA-h9h9-2rmf-rvhp x_refsource_CONFIRM
https://github.com/junrar/junrar/commit/687a09c42f46066447faa9179ee11314ad6d9afb x_refsource_MISC
https://github.com/junrar/junrar/releases/tag/v7.6.1 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-15
Last updated: 2026-10-16
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.4%

Probability of exploitation in 30 days

34.6%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')