CVE-2025-11579

What it actually does

The library fails to enforce an upper bound on the RAR dictionary size parameter, allowing a malicious archive to trigger unbounded memory allocation that results in an out-of-memory crash.

Why it matters to the business

Systems that unpack or inspect RAR archives can be forced offline or become unresponsive, interrupting services that rely on archive processing and requiring manual restarts or reboots.

How an attack unfolds

An attacker crafts a RAR archive with an excessively large dictionary size, then supplies the file to any process using the vulnerable rardecode library; when the library reads the archive header it allocates memory proportional to the declared size and crashes.

How to fix it

Upgrade nwaples/rardecode to commit 52fb4e825c936636f251f7e7deded39ab11df9a9 or later; for SUSE packages update google-guest-agent to 20250116.00-150000.1.57.1 or newer on the listed products. Where immediate patching is not possible, restrict untrusted RAR files from reaching archive-processing code paths.

How to confirm the fix worked

Confirm the installed rardecode or google-guest-agent package version matches or exceeds the listed fixed versions; test by attempting to process a RAR with a large dictionary size and verifying the process no longer crashes.

Typical attack path

1. Identify a target that accepts or processes RAR files via google-guest-agent or the rardecode library
2. Generate a specially crafted RAR archive containing an oversized dictionary size value
3. Deliver the archive to the target through upload, email attachment, or automated update channel
4. Trigger archive processing so the library attempts the unbounded allocation
5. Observe the resulting out-of-memory crash and service disruption

How to detect it

Look for repeated out-of-memory termination events or abrupt process exits in logs of services that handle RAR files; correlate with file-creation or upload events involving RAR archives immediately preceding the crash.

What your security team should do

• Apply the listed fixed package versions immediately on all affected SUSE and openSUSE systems
• Add archive-size and memory-usage limits around any RAR processing workflows until patches are deployed
• Monitor for repeated out-of-memory events on hosts running google-guest-agent
• Review and restrict inbound RAR file sources to reduce exposure surface