Critical Security Flaws in libarchive and bsdtar: Information Disclosure and Code Execution Risks
Summary
ALSA-2026:8534: Important: libarchive security update. Affects bsdtar versions < 3.3.3-7.el8_10. Fixed in 3.3.3-7.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libarchive is a programming library that facilitates the creation and reading of various streaming archive formats, such as GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in tools like bsdtar, scripting language bindings (e.g., python-libarchive), and popular desktop file managers. The library's extensive use makes it a critical component in many software applications, thus highlighting the importance of its security.
Vulnerability Detail
The vulnerabilities in libarchive stem from improper handling of certain archive formats. Specifically, CVE-2026-4424 allows for information disclosure through a heap out-of-bounds read during RAR archive processing, potentially exposing sensitive data. Meanwhile, CVE-2026-5121 presents a risk of arbitrary code execution due to an integer overflow in ISO9660 image processing, which could allow an attacker to execute malicious code on the affected system. These vulnerabilities pose significant risks to systems utilizing libarchive, as they can lead to unauthorized access and control.
How To Fix
Minimum fixed version
3.3.3-7.el8_10
This is the first release that contains the fix.
sudo dnf update bsdtarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted RAR and ISO9660 files until the packages are updated. This can help mitigate the risk of exploitation while waiting for the patch.
Conclusion
The vulnerabilities in libarchive and bsdtar present serious security risks, including information disclosure and arbitrary code execution. It is crucial for users to update their packages to the latest patched versions to safeguard their systems. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for bsdtar →
FAQ
The main vulnerabilities include information disclosure via heap out-of-bounds read in RAR archive processing and arbitrary code execution due to integer overflow in ISO9660 image processing.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
As a workaround, avoid processing untrusted RAR and ISO9660 files until the packages are updated to reduce the risk of exploitation.
Updating to this version ensures that the known vulnerabilities are patched, thereby protecting your system from potential attacks.
For detailed information, refer to the CVE pages listed in the references section of the security advisory.
Related vulnerabilities
Recent vulnerabilities recorded for bsdtar.
