FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

unarr -- multiple vulnerabilities in the rar, zip and tar readers

Affected packages
		unarr	<	1.2.0

Details

VuXML ID	6f31f4ab-d5fd-11f1-b2f0-002b67dfc673
Discovery	2026-10-15
Entry	2026-11-01

The unarr project reports:

rar: Fix OOB read in rar_conv_unicode_to_utf8

rar: Prevent heap overflow when copying filters into RAR VM

zip: Fix off-by-3 heap out-of-bounds read in ZIP64 extra field parser

tar: Fix off-by-1 heap overflow in tar_get_name when concatenating USTAR filename and prefix at full length

[source]

References

CVE Name	CVE-2026-111273
CVE Name	CVE-2026-111274
URL	https://github.com/selmf/unarr/blob/v1.2.0/CHANGELOG.md
URL	https://github.com/selmf/unarr/security/advisories/GHSA-3pwm-h93f-p4qh
URL	https://github.com/selmf/unarr/security/advisories/GHSA-fj4h-mpx9-46qj
URL	https://github.com/selmf/unarr/security/advisories/GHSA-qm4g-jf39-jwjj
URL	https://github.com/selmf/unarr/security/advisories/GHSA-r5fr-9636-6xpp