CVE-2016-1541

What it actually does

Heap-based buffer overflow in zip_read_mac_metadata during ZIP archive parsing allows remote attackers to execute arbitrary code via crafted entry-size values.

Why it matters to the business

Systems that process untrusted ZIP archives using vulnerable libarchive versions face risk of full system compromise, data theft, or ransomware deployment; the library's wide use in backup, packaging, and container tools amplifies exposure across many environments.

How an attack unfolds

An attacker crafts a ZIP archive containing malicious entry-size metadata values that trigger the buffer overflow in the zip_read_mac_metadata function; when a victim application or service processes the archive with an affected libarchive version, the overflow leads to arbitrary code execution under the privileges of the parsing process.

How to fix it

Upgrade libarchive to a version containing commit d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7 or later (3.2.0+); for kubeflow-pipelines and kubeflow-pipelines-apiserver on Chainguard or Wolfi, update to 2.2.0-r6 or newer. Rebuild and redeploy any dependent containers or packages after the update.

How to confirm the fix worked

Confirm installed libarchive version is at or above the fixed commit or release; run regression tests with known-malformed ZIP samples that previously triggered the overflow; verify no crashes or unexpected behavior during archive extraction in staging environments.

Typical attack path

1. Craft a malicious ZIP archive with oversized or malformed entry-size values targeting the zip_read_mac_metadata path
2. Deliver the archive via email, download, or supply-chain vector to a target system
3. Trigger processing of the archive through user action, automated backup, or application ingestion
4. Achieve code execution and establish persistence or escalate privileges

How to detect it

Review application and system logs for segmentation faults or crashes during ZIP extraction; search for invocations of zip_read_mac_metadata or archive_read_support_format_zip in process traces; correlate with file creation or execution events shortly after archive processing.

• zip_read_mac_metadata
• archive_read_support_format_zip.c
• SIGSEGV during ZIP extraction

What your security team should do

• Prioritize patching all instances of libarchive and dependent packages within the next maintenance window due to remote code execution potential
• Inventory applications and pipelines that ingest untrusted ZIP files and enforce input sanitization or sandboxing until patched
• Update build pipelines to pull only fixed versions of kubeflow-pipelines components
• Monitor for new exploit code or public PoCs given the CVE's age and moderate EPSS