PT-2026-5229 · Unknown+1 · Bulk Extractor+1

Mobasi-Team · Published 2026-01-28 · Updated 2026-02-09 · CVE-2026-24857

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bulk extractor versions 1.4 and later

Description bulk extractor is a digital forensics exploitation tool. The embedded unrar code within bulk extractor, starting with version 1.4, contains a heap-buffer-overflow in the RAR PPM LZ decoding path. A specially crafted RAR archive within a disk image can trigger an out-of-bounds write in the Unpack::CopyString function, resulting in a crash. This could potentially lead to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

CVE-2026-24857

GHSA-RH8M-9XRX-Q64Q

Affected Products

Unrar

Bulk Extractor

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24857.json · Exploit
• 🔥 https://github.com/simsong/bulk_extractor/security/advisories/GHSA-rh8m-9xrx-q64q · Exploit
• https://osv.dev/vulnerability/CVE-2026-24857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24857 · Security Note
• https://twitter.com/CVEnew/status/2016631017164198400 · Twitter Post
• https://t.me/CVEtracker/43204 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2016642797613330595 · Twitter Post
• https://t.me/cveNotify/151444 · Telegram Post