Moderate Vulnerability in libarchive: Double-Free Issue in RAR5 Decompression Logic
Summary
RLSA-2026:52675: Moderate: libarchive security update. Affects libarchive versions < 0:3.7.7-10.el10_2. Fixed in 0:3.7.7-10.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a versatile programming library designed for creating and reading various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in tools such as the bsdtar utility, scripting language bindings like python-libarchive, and numerous popular desktop file managers. This library's functionality is critical for managing archive files, making it a common component in many software distributions.
Vulnerability Detail
The vulnerability identified as CVE-2026-14164 is a double-free issue in the RAR5 decompression logic of libarchive. This flaw arises from a dangling pointer, specifically the filtered_buf pointer in the init_unpack() function. If exploited, this vulnerability could lead to application crashes or potentially allow an attacker to execute arbitrary code, thereby compromising the integrity and security of the affected systems.
How To Fix
Minimum fixed version
0:3.7.7-10.el10_2
This is the first release that contains the fix.
sudo dnf update libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the RAR5 decompression functionality until the package is updated. This will help prevent potential exploitation of the vulnerability until a proper fix is applied.
Conclusion
The libarchive library has a moderate vulnerability (CVE-2026-14164) that can lead to serious security risks if not addressed. Users are advised to update to the latest version to ensure their systems remain secure. Temporary workarounds are available, but the best course of action is to apply the patch as soon as possible.
See every vulnerability recorded for libarchive →
FAQ
CVE-2026-14164 is a vulnerability in the libarchive library that involves a double-free issue in the RAR5 decompression logic, which can lead to application crashes or arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a moderate severity level.
If an immediate update is not possible, refrain from using the RAR5 decompression functionality as a temporary workaround to mitigate risk.
libarchive is maintained by the Rocky Enterprise Software Foundation and Red Hat, who are responsible for addressing security vulnerabilities and providing updates.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
