CVE-2026-4424: Libarchive Rar Lzss Sign Compare

A signed/unsigned comparison vulnerability exists when validating the LZSS sliding window size. `(mask + 1)` is implicitly evaluated as a signed integer, which causes security checks against `dictionary_size` to fail if `mask + 1` becomes negative or has representation mismatches. Cast the signed operand to `unsigned int` to fix the issue.

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0c
greprules fetch cve-2026-4424-libarchive-rar-lzss-sign-compare --engine opengrep

Description

A signed/unsigned comparison vulnerability exists when validating the LZSS sliding window size. `(mask + 1)` is implicitly evaluated as a signed integer, which causes security checks against `dictionary_size` to fail if `mask + 1` becomes negative or has representation mismatches. Cast the signed operand to `unsigned int` to fix the issue.

Detection target

Not provided

Recommended fix

Not provided

False-positive notes

Not provided

Community feedback

Sign in to report false positives, mark this rule useful, or suggest metadata improvements.