Critical Security Flaw in libarchive and bsdtar: Heap Out-of-Bounds Read Vulnerability
Summary
ALSA-2026:8492: Important: libarchive security update. Affects bsdtar versions < 3.7.7-8.el10_1. Fixed in 3.7.7-8.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libarchive is a versatile programming library that enables the creation and reading of various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in tools such as the bsdtar utility, Python bindings like python-libarchive, and numerous desktop file managers. This library's extensive use makes it a critical component in many software applications, and any vulnerabilities can have far-reaching implications.
Vulnerability Detail
The vulnerability identified as CVE-2026-4424 pertains to an information disclosure issue caused by a heap out-of-bounds read during the processing of RAR archives in libarchive. This flaw can potentially allow attackers to read sensitive data from memory, leading to unauthorized information disclosure. The vulnerability arises from improper handling of memory boundaries, which can be exploited if an attacker crafts a malicious RAR archive.
How To Fix
Minimum fixed version
3.7.7-8.el10_1
This is the first release that contains the fix.
sudo dnf update bsdtarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted RAR archives until the update has been applied. This precaution can help mitigate the risk of exploitation while waiting for the patch.
Conclusion
The libarchive vulnerability (CVE-2026-4424) poses a significant risk due to its potential for information disclosure through heap out-of-bounds reads. Users are strongly advised to update their affected packages to the latest patched versions to safeguard their systems. Implementing the recommended updates and avoiding untrusted archives will help mitigate the risks associated with this vulnerability.
See every vulnerability recorded for bsdtar →
FAQ
CVE-2026-4424 is a vulnerability in the libarchive library that allows for information disclosure through a heap out-of-bounds read when processing RAR archives.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
If exploited, this vulnerability could allow attackers to access sensitive information from memory, which could lead to further attacks or data breaches.
Yes, a patch has been released in version 3.7.7-8.el10_1 for libarchive, bsdtar, and libarchive-devel. Users should update to this version or later.
If you cannot update immediately, avoid processing any untrusted RAR archives to minimize the risk of exploitation until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for bsdtar.
