Security readout for executives and security teams
Plain-English summary
CVE-2026-24857 affects bulk_extractor, a digital forensics tool. A specially crafted RAR file embedded in a disk image can trigger memory corruption in the tool’s bundled unrar code. The documented impact is crash, with potential remote code execution not proven in the provided sources. No patch was identified at publication.
Executive priority
Treat this as a moderate operational risk for teams handling untrusted forensic images. Prioritize isolation and exposure reduction because no patch is named in the provided sources. Urgency is higher for automated pipelines or high-volume forensic environments where crafted evidence could be processed without human review.
Technical view
Versions 1.4 through 2.1.1 of simsong bulk_extractor contain a heap-based buffer overflow in the embedded unrar RAR PPM LZ decoding path. The out-of-bounds write occurs in Unpack::CopyString when processing a crafted RAR inside a disk image. CVSS v4.0 is 5.5, with low availability impact and exploit maturity marked proof-of-concept.
Likely exposure
Exposure is most relevant to forensic labs, incident response teams, malware analysis pipelines, and automated evidence-processing systems that run bulk_extractor on untrusted disk images or archives. Systems not using bulk_extractor, or not enabling workflows that process RAR content from untrusted images, are less likely to be exposed.
Exploitation context
The advisory describes a crafted RAR inside a disk image causing an ASAN crash and likely crash or memory corruption in production builds. It notes potential for RCE, but the provided sources do not confirm working code execution or active exploitation. The CVE is not listed as KEV in the supplied data.
Researcher notes
Evidence is limited to the CVE record and GitHub advisory. The issue is CWE-122 heap-based buffer overflow in embedded unrar handling. Sources report ASAN crash and possible RCE potential, but not confirmed exploitation. Avoid assuming exploitability beyond memory corruption unless new vendor or researcher evidence becomes available.
Mitigation direction
- Check the GitHub advisory and vendor project for patch or workaround updates.
- Avoid processing untrusted disk images with affected bulk_extractor versions where possible.
- Run forensic processing in isolated, least-privileged sandbox environments.
- Restrict automated ingestion of external images until vendor guidance is available.
- Track affected installations of bulk_extractor versions 1.4 through 2.1.1.
Validation and detection
- Inventory bulk_extractor deployments and record installed versions.
- Confirm whether versions are between 1.4 and 2.1.1 inclusive.
- Review forensic pipelines for automatic processing of untrusted disk images.
- Check whether sandboxing, privilege reduction, and job isolation are enforced.
- Monitor the GitHub advisory for updated remediation information.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-122: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-24857 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.5MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/simsong/bulk_extractor/security/advisories/GHSA-rh8m-9xrx-q64qCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Heap-based Buffer Overflow
Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.