Critical Vulnerability in libarchive: Information Disclosure via Heap Out-of-Bounds Read
Summary
RLSA-2026:8492: Important: libarchive security update. Affects libarchive versions < 0:3.7.7-8.el10_1. Fixed in 0:3.7.7-8.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a versatile programming library designed to create and read various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in tools such as the bsdtar utility, scripting language bindings like python-libarchive, and numerous popular desktop file managers. This library's functionality makes it a crucial component in many software applications, but it also exposes them to potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2026-4424 in libarchive is a critical issue that allows for information disclosure through a heap out-of-bounds read during the processing of RAR archives. This flaw can potentially lead to unauthorized access to sensitive information stored in memory, posing significant risks to the confidentiality of data. The vulnerability arises from improper handling of certain archive formats, which can be exploited by attackers to read beyond the allocated memory bounds.
How To Fix
Minimum fixed version
0:3.7.7-8.el10_1
This is the first release that contains the fix.
sudo dnf update libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing RAR archives until the libarchive package is updated to the fixed version (0:3.7.7-8.el10_1). This will help mitigate the risk of exploitation until a permanent fix is applied.
Conclusion
The libarchive library has a critical vulnerability (CVE-2026-4424) that can lead to information disclosure through heap out-of-bounds reads. It is crucial to update to the patched version to safeguard against potential data breaches. Users are advised to implement the recommended fixes and workarounds to mitigate risks.
See every vulnerability recorded for libarchive →
FAQ
CVE-2026-4424 is a security vulnerability in the libarchive library that allows for information disclosure via a heap out-of-bounds read when processing RAR archives.
If your system uses libarchive and processes RAR archives, it may be susceptible to unauthorized access to sensitive information, which can compromise data confidentiality.
If an immediate update is not possible, refrain from processing RAR archives until the library is updated to mitigate the risk of exploitation.
Detailed information about CVE-2026-4424 can be found on the official CVE page and security advisories related to libarchive.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just a manifest file like package-lock.json, allowing you to check if your application is affected without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
