CVE-2026-24857 is a critical heap buffer overflow (CVSS 9.8) in bulk_extractor, the digital forensics tool. Its embedded unrar code can write out of bounds when it decodes a crafted RAR, even one buried inside a disk image. The advisory lists 2.2.0 as the patched version, so upgrade from any release between 1.4 and 2.1.x.
What's affected
- Affected: bulk_extractor 1.4 up to, but not including, 2.2.0.
- Fixed in: 2.2.0.
The NVD description, written when the advisory went public, said no patch was available. The advisory now lists 2.2.0 as patched, so use the advisory over the older text in the record.
The flaw sits in the PPM LZ decoding path of the bundled RAR code, in a function that copies matched strings. The advisory says the bounds check on the fast path does not account for the length of the copy, so a large match near the end of the window writes past the buffer.
How to check if you're exposed
Run the tool with its version flag and compare against 2.2.0.
bulk_extractor -V
If you installed from a distribution package, check your package manager for the installed version. If you build from source, check the tag you built from. Forensic workstations often keep an old build around for case reproducibility, so look at lab images and analysis VMs too.
What to do now
- Upgrade bulk_extractor to 2.2.0 or later on every analysis host.
- Until you have upgraded, avoid scanning untrusted images with the RAR scanner enabled, or run the tool in a disposable VM with no network access and no access to case data.
- Treat the output of any run against a hostile image on an old build as untrusted, because a crash may hide memory corruption.
- Record the tool version in your case notes so results can be tied to a patched build.
Why it matters
The class is a heap overflow, covered by CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The reporter confirmed a crash under a memory checker. The advisory also notes that code execution was never demonstrated, though it is possible in theory for a heap overflow. Plan for the crash case and treat code execution as a risk you cannot rule out.
Forensic tools exist to open files you do not trust. That makes parser bugs in them more serious than in a tool that handles your own data. Run them in isolated environments by default.
Quick check
Is this exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the advisory does not report in the wild use.
Does the fix cover the unrar code or only the tool?
The advisory lists bulk_extractor 2.2.0 as the patched version. Read the release notes for that version to see how the bundled code was changed.
Sources
Last reviewed: 19 October 2026.
