CVE-2026-97370

Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1.

• CWE-835

• https://github.com/junrar/junrar/commit/687a09c42f46066447faa9179ee11314ad6d9afb
• https://github.com/junrar/junrar/releases/tag/v7.6.1
• https://github.com/junrar/junrar/security/advisories/GHSA-h9h9-2rmf-rvhp

Published

Oct 15, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97362HFS2 version 2.4.0 and earlier contains a denial of service …7.5
• CVE-2026-97363The WebSocket Application Programming Interface lacks restri…7.5
• CVE-2026-97365A vulnerability was determined in chonkie-inc littrs 0.6.1/0…6.3
• CVE-2026-97366A security flaw has been discovered in jhen0409 react-native…6.3
• CVE-2026-97368A weakness has been identified in chillzhuang SpringBlade up…6.3
• CVE-2026-9737During query planning when reading the sort pattern in raw B…6.5
• CVE-2026-9738The Print, PDF, Email by PrintFriendly plugin for WordPress …4.4
• CVE-2026-97380MariaDB server is a community developed fork of MySQL server…8.8
• CVE-2026-97381Legacy Update is a tool for activating and installing update…9.9
• CVE-2026-97387Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-9739Vulnerable to DNS rebinding attacks when using SSE (http://b…9.4
• CVE-2026-97394kin-openapi is a Go project for handling OpenAPI files. From…7.5