Critical Security Flaw in libarchive: Heap Overflow and Signed Integer Overflow Vulnerabilities
Summary
RLSA-2026:69553: Low: libarchive security update. Affects libarchive versions < 0:3.7.7-11.el10_2. Fixed in 0:3.7.7-11.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a versatile programming library that facilitates the creation and reading of various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in tools such as the bsdtar utility, Python bindings like python-libarchive, and numerous desktop file managers. Given its extensive use, vulnerabilities in libarchive can have far-reaching implications, affecting many applications and systems reliant on this library.
Vulnerability Detail
The vulnerabilities identified in libarchive include a heap overflow out-of-bounds read when parsing a tar archive containing a PAX extended header (CVE-2026-15028) and a signed integer overflow in the archive_write_zip_header function (CVE-2026-16517). These vulnerabilities can lead to potential exploitation, allowing attackers to read sensitive data or execute arbitrary code, thereby compromising the integrity and confidentiality of affected systems.
How To Fix
Minimum fixed version
0:3.7.7-11.el10_2
This is the first release that contains the fix.
sudo dnf update libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted tar archives or disable features that rely on PAX extended headers until the update is applied. This can help mitigate the risk of exploitation while waiting for the official patch.
Conclusion
The vulnerabilities in libarchive pose significant risks to systems that rely on this library for handling archive formats. It is crucial to update to the patched version to mitigate these risks. Users should also consider using tools like Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for libarchive →
FAQ
libarchive is a programming library that allows for the creation and reading of various archive formats, making it essential for many file management and compression tasks.
The vulnerabilities include a heap overflow out-of-bounds read and a signed integer overflow, both of which can lead to serious security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for the vulnerabilities in libarchive is 3.9, indicating a low severity level.
If an immediate update is not possible, avoid processing untrusted tar archives and consider disabling features that utilize PAX extended headers as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
