libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9

Exploitation

poc

Automatable

no

Technical impact

partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

1. Sep 14, 2026Published

   Disclosed via NVD

2. Sep 14, 2026CVSS changed

   2.5 → 4.7

3. Sep 14, 2026Severity changed

   low → medium

4. Sep 15, 2026EPSS first tracked

   0.1%

5. Sep 16, 2026Public exploit observed

   Exploit / PoC code exists

6. Sep 16, 2026CVSS changed

   4.7 → 2.5

7. Sep 16, 2026Severity changed

   medium → low

8. Sep 25, 2026EPSS peak

   0.1% → 0.2%

9. Oct 14, 2026Record revised

   Last analysed / modified upstream

Change history

Field changes observed since this record was first indexed.

• Sep 16, 2026Public exploit / PoC published
• Sep 16, 2026CVSS 4.7 → 2.5
• Sep 16, 2026Severity medium → low
• Sep 14, 2026CVSS 2.5 → 4.7
• Sep 14, 2026Severity low → medium