USN-8902-1: signed integer overflow vulnerability in libarchive when processing encrypted ZIP entries
Ubuntu Security notice on a signed integer overflow in the libarchive ZIP writer when processing encrypted entries, with risk of crash or arbitrary code execution.
Notice USN-8902-1, republished in the Ubuntu Security feed and dated October 8, 2026, describes a signed integer overflow in the ZIP writer of the libarchive library. The problem occurs when processing encrypted entries with sizes near the maximum value. According to the text, an attacker could possibly exploit this flaw to make libarchive crash or run arbitrary code. The content received is an automatic translation, so exact technical terms should be checked against the original.
For teams that depend on compression libraries, the relevant step is to identify where libarchive is installed, including inside container images and third-party tools, and to apply the update indicated by the vendor. This text does not give a fixed version number, so the check must be made in the official notice. To verify the source, search for the identifier USN-8902-1 on the Ubuntu security notices site and compare the installed version with the fixed version listed there.