Critical Security Update for libarchive: Addressing CVE-2026-14164
Summary
RHSA-2026:58574: Red Hat Security Advisory: libarchive security update. Affects bsdcat-debuginfo versions < 0:3.5.3-5.el9_2.3. Fixed in 0:3.5.3-5.el9_2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a widely used library that provides a flexible and efficient way to read and write various archive formats, including tar, zip, and cpio. It is integral to many applications and systems for managing file archives. The library's functionality allows users to create, extract, and manipulate archive files seamlessly. However, vulnerabilities in libarchive can lead to severe security risks, making it crucial for users to stay updated with the latest security patches.
Vulnerability Detail
CVE-2026-14164 is a security vulnerability identified in libarchive that could allow an attacker to exploit the library's functionality, potentially leading to unauthorized access or denial of service. The vulnerability arises from improper handling of certain archive formats, which could be leveraged by malicious actors to execute arbitrary code or crash applications that rely on libarchive. The ramifications of this vulnerability can be severe, affecting the integrity and availability of systems that utilize the library.
How To Fix
Minimum fixed version
0:3.5.3-5.el9_2.3
This is the first release that contains the fix.
sudo dnf update bsdcat-debuginfoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the vulnerable features of libarchive until the update is applied. Additionally, restricting access to applications that utilize libarchive may help mitigate potential exploitation.
Conclusion
In summary, CVE-2026-14164 is a critical vulnerability in the libarchive library that poses significant security risks. Users are strongly advised to update their packages to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for bsdcat-debuginfo →
FAQ
CVE-2026-14164 is a security vulnerability in the libarchive library that could allow attackers to exploit the library's functionality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2026-14164 is 7.5, indicating a high severity level.
If an immediate update is not possible, consider restricting access to the applications that utilize libarchive as a temporary workaround.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:58574.json.
Related vulnerabilities
Recent vulnerabilities recorded for bsdcat-debuginfo.
