Critical Security Flaw in libarchive and bsdtar: Information Disclosure and Code Execution Risks
Summary
ALSA-2026:8510: Important: libarchive security update. Affects bsdtar versions < 3.5.3-9.el9_7. Fixed in 3.5.3-9.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a versatile programming library that enables the creation and reading of various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in the bsdtar utility, scripting language bindings like python-libarchive, and several popular desktop file managers. This library's extensive use makes it a critical component in many software applications, thus highlighting the importance of maintaining its security.
Vulnerability Detail
The vulnerability arises from two significant issues in libarchive: an information disclosure vulnerability due to a heap out-of-bounds read when processing RAR archives (CVE-2026-4424) and an arbitrary code execution risk stemming from an integer overflow in ISO9660 image processing (CVE-2026-5121). These vulnerabilities can potentially allow attackers to exploit the library, leading to unauthorized access to sensitive information or execution of malicious code.
How To Fix
Minimum fixed version
3.5.3-9.el9_7
This is the first release that contains the fix.
sudo dnf update bsdtarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected features of libarchive until the packages are updated. It is advisable to refrain from processing untrusted RAR archives or ISO9660 images until the vulnerabilities are patched.
Conclusion
The vulnerabilities in libarchive and bsdtar pose significant risks, including information disclosure and arbitrary code execution. It is crucial for users to update their packages to the patched version to mitigate these risks. Additionally, employing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for bsdtar →
FAQ
The main vulnerabilities include an information disclosure issue due to a heap out-of-bounds read in RAR archive processing and an arbitrary code execution risk from an integer overflow in ISO9660 image processing.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If immediate updates are not possible, avoid processing untrusted RAR archives or ISO9660 images as a temporary workaround until the vulnerabilities are patched.
For more details, refer to the CVE pages for CVE-2026-4424 and CVE-2026-5121, which provide insights into the vulnerabilities and their impacts.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without signing up.
Related vulnerabilities
Recent vulnerabilities recorded for bsdtar.
