Moderate Vulnerability in libarchive and bsdtar: Double-Free Issue in RAR5 Decompression
Summary
ALSA-2026:52674: Moderate: libarchive security update. Affects bsdtar versions < 3.5.3-11.el9_8. Fixed in 3.5.3-11.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Libarchive is a versatile programming library that facilitates the creation and reading of various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in tools like bsdtar, scripting language bindings such as python-libarchive, and numerous desktop file managers. This library's functionality is critical for managing archive files efficiently, but it has been found to have a security vulnerability that could potentially compromise systems using it.
Vulnerability Detail
The vulnerability identified as CVE-2026-14164 is a double-free issue in the RAR5 decompression logic of the libarchive library. This flaw arises from a dangling pointer, specifically the filtered_buf pointer in the init_unpack() function. If exploited, this vulnerability could lead to memory corruption, potentially allowing an attacker to execute arbitrary code or crash the application, thereby compromising the integrity and availability of the system.
How To Fix
Minimum fixed version
3.5.3-11.el9_8
This is the first release that contains the fix.
sudo dnf update bsdtarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the RAR5 decompression feature until the packages are updated. This may involve using alternative archive formats or tools that do not rely on libarchive for RAR5 files.
Conclusion
The libarchive library, essential for handling various archive formats, has a moderate vulnerability that could lead to severe consequences if not addressed. Users are strongly advised to update their packages to the latest version to ensure their systems remain secure. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for bsdtar →
FAQ
The impact includes potential memory corruption, which could allow attackers to execute arbitrary code or crash applications that utilize the libarchive library.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply providing a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Versions prior to 3.5.3-11.el9_8 are affected. It is crucial to update to this version or later to mitigate the risk.
While the best practice is to update, a temporary workaround is to refrain from using the RAR5 decompression feature until the update is applied.
More details can be found on the CVE page for CVE-2026-14164, which provides in-depth information about the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for bsdtar.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
