Vulnerability Spotlight: Lhasa Integer Underflow Exploit
Summary: Cisco Talos disclosed CVE-2016-2347, an integer underflow in the Lhasa LZH/LHA decompression tool and library, found by Marcin Noga; the software checks that header values are not too large but not that header length is too small. A file with an under-value header size causes the decompressor to allocate a pointer to released heap memory, letting an attacker who controls the file's length and content overwrite the heap with arbitrary code.
Why it matters: The less obvious path is file-scanning systems that use the Lhasa library to read LZH and LHA attachments and downloads, which requires no user interaction and is often overlooked as a way to execute code remotely - so a vulnerable open-source library inside a third-party scanner can become the way your controls are circumvented.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-2347
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026