Critical Security Flaws in libarchive: Information Disclosure and Code Execution Risks
Summary
RLSA-2026:8510: Important: libarchive security update. Affects libarchive versions < 0:3.5.3-9.el9_7. Fixed in 0:3.5.3-9.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a versatile programming library that facilitates the creation and reading of various streaming archive formats, such as GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in tools like the bsdtar utility, scripting language bindings (e.g., python-libarchive), and numerous popular desktop file managers. Given its extensive use, vulnerabilities in libarchive can have significant implications for system security.
Vulnerability Detail
The vulnerabilities in libarchive stem from improper handling of certain archive formats. Specifically, CVE-2026-4424 allows for information disclosure through a heap out-of-bounds read when processing RAR archives, potentially exposing sensitive data. Meanwhile, CVE-2026-5121 presents a more severe risk, enabling arbitrary code execution due to an integer overflow during ISO9660 image processing. These vulnerabilities can be exploited by attackers to gain unauthorized access or execute malicious code, posing a critical threat to systems utilizing the library.
How To Fix
Minimum fixed version
0:3.5.3-9.el9_7
This is the first release that contains the fix.
sudo dnf update libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing RAR and ISO9660 archives until the update is applied. This will help mitigate the risk of exploitation while waiting for the official patch.
Conclusion
The vulnerabilities in libarchive represent significant security risks that can lead to information disclosure and arbitrary code execution. It is crucial for users to update to the patched version promptly and consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for libarchive →
FAQ
libarchive is a programming library that allows users to create and read various archive formats, making it essential for file management and data storage.
The vulnerabilities include an information disclosure risk via heap out-of-bounds read in RAR archives (CVE-2026-4424) and arbitrary code execution due to integer overflow in ISO9660 image processing (CVE-2026-5121).
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities in real-time.
The CVSS score for these vulnerabilities is 7.5, indicating a high severity level that requires immediate attention.
If an immediate update is not possible, refrain from processing RAR and ISO9660 archives to minimize the risk of exploitation until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
