CVE-2020-9308: Canonical Ubuntu Linux

High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days.

archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

Affected products

• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 19.10 only
• Fedoraproject Fedora: version 31 only; version 32 only
• Libarchive Libarchive: from 3.4.0, before 3.4.2 (fixed in 3.4.2)

Published 2020-02-20. Last modified 2026-06-17.