A stack buffer overflow occurs in file‑roller when it parses the progress line of 7z or RAR archives that contain a file entry with an excessively long path. The overflow is caused by an unbounded string copy into a fixed‑size stack buffer, which triggers an immediate crash. The flaw produces a denial of service because file‑roller terminates without completing the operation. This weakness is a classic buffer copy without length check (CWE‑120).

The vulnerability affects the file‑roller utility shipped with Red Hat Enterprise Linux 6, 7 and 8. Any system installing the standard file‑roller binary built for these operating system releases is potentially vulnerable.

The CVSS score of 6.5 indicates a moderate impact. EPSS is not available and the flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The attacker must possess the ability to run file‑roller on the victim’s system and supply a malicious 7z or RAR archive with an overly long path; thus the attack vector is local or requires user‑interaction. No known public exploit code exists, and the exploit would simply crash the program, yielding a denial of service to the user.