An infinite loop is triggered in libarchive’s RAR5 decompression when a specially crafted archive is processed, causing continuous CPU consumption. The archive passes checksum validation and appears structurally valid, so the application cannot detect the issue before use. The result is a persistent denial‑of‑service condition affecting any service that automatically processes such archives.

Red Hat AI Inference Server 3.2, Red Hat Discovery 2, Red Hat Enterprise Linux 10, 8, 7, 6, and RHEL 9 (including base, appstream, extended update support 9.0, 9.2, 9.4, 9.6), Red Hat Hardened Images, and OpenShift Container Platform 4 are all impacted by the libarchive vulnerability.

The CVSS score of 7.5 indicates a moderately high severity, but the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild as of now. It is not listed in the CISA KEV catalog. The vulnerability requires an attacker to deliver a malicious RAR5 archive to the target process, which could occur through remote upload or local file consumption depending on the application’s configuration. No known public exploit has been observed, but the lack of detection means that legitimate looking archives can silently consume system resources.