bulk_extractor includes embedded unrar code that contains a heap-based buffer overflow in the RAR PPM LZ decoding path starting with version 1.4. When a specially crafted RAR archive is embedded inside a disk image, the Unpack::CopyString function performs an out-of-bounds write, which can crash the program or corrupt memory. The resulting corruption gives an attacker the potential to achieve remote code execution. The flaw is a classic heap overflow (CWE122) and an out-of-bounds write (CWE787).

The vulnerability affects the bulk_extractor forensic tool produced by Simson Garfinkel. Versions 1.4 and newer are impacted because the fault appears in the embedded unrar code shipped with 1.4 and later releases.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % implies low exploitation likelihood at present. The flaw is not listed in the CISA KEV catalog. Attack vectors are likely local: an attacker must supply a malicious disk image that contains a specially crafted RAR archive. If an attacker can perform the extraction on a system where bulk_extractor runs, the memory corruption could lead to arbitrary code execution, compromising the host. The absence of an available patch means the risk remains until a fix is released.