CVE-2026-97370

Name of the Vulnerable Software and Affected Versions Junrar versions prior to 7.6.1

Description An issue exists in the RAR virtual machine where a crafted RAR4 archive can force the extraction thread into a deterministic infinite CPU loop. This occurs because the RarVM.ExecuteCode function in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM JMP instruction. When the setIP() function is called with a target instruction pointer greater than or equal to the codeSize variable, it returns success without updating the instruction pointer or decrementing the maxOpCount variable. Consequently, the jump handler continues the loop, bypassing the loop-end accounting and causing the thread to spin indefinitely. This leads to a denial of service by exhausting archive-processing worker capacity and consuming CPU resources. The RAR virtual machine does not expose native process execution, limiting the impact to availability loss.

Recommendations Update to version 7.6.1.