Moderate Vulnerability in libarchive and bsdtar: Double-Free Issue in RAR5 Decompression
Summary
ALSA-2026:52675: Moderate: libarchive security update. Affects bsdtar versions < 3.7.7-10.el10_2. Fixed in 3.7.7-10.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Libarchive is a versatile programming library that supports the creation and reading of various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in tools like bsdtar, scripting language bindings such as python-libarchive, and numerous desktop file managers. This library's functionality is crucial for managing compressed files and archives, making it a key component in many software applications.
Vulnerability Detail
The vulnerability identified as CVE-2026-14164 is a double-free issue in the RAR5 decompression logic of the libarchive library. This flaw arises from a dangling pointer, filtered_buf, in the init_unpack() function, which can lead to memory corruption and potential exploitation by an attacker. If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code or cause a denial of service, impacting the stability and security of applications relying on libarchive.
How To Fix
Minimum fixed version
3.7.7-10.el10_2
This is the first release that contains the fix.
sudo dnf update bsdtarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider avoiding the use of RAR5 archives until the package has been updated. However, this is not a permanent solution and updating to the patched version is strongly recommended.
Conclusion
The libarchive library, widely used for managing various archive formats, has a moderate vulnerability (CVE-2026-14164) that can lead to serious security risks. Users are advised to update their packages to the latest patched versions to ensure their systems remain secure.
See every vulnerability recorded for bsdtar →
FAQ
CVE-2026-14164 is a vulnerability in the libarchive library that involves a double-free error in the RAR5 decompression logic, potentially leading to memory corruption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could allow attackers to execute arbitrary code or cause a denial of service, compromising the security and stability of applications using libarchive.
Update the affected packages to the patched version (3.7.7-10.el10_2 or later) using your package manager to mitigate the risk associated with this vulnerability.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for bsdtar.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
