Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 2

Vulnerabilities 6

• High 7.5
  CVE-2026-4111

  Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive

  A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where interna…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Mar 13, 2026
• High 7.5
  CVE-2026-4424

  Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

  A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Wolfi
  Mar 19, 2026
• High 7.5
  CVE-2026-5121

  Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

  A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overfl…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Wolfi
  Mar 30, 2026
• Medium 6.5
  CVE-2026-4426

  Libarchive: libarchive: denial of service via malformed iso file processing

  A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a sp…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Wolfi
  Mar 19, 2026
• Medium 5.5
  CVE-2025-60753

  An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c wh…

  libarchive libarchive libarchive Debian Ubuntu Azure Linux
  Nov 5, 2025
• Medium 5.5
  CVE-2026-5745

  Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive

  A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subseque…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Apr 7, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2025-60753
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-4424
• report
  https://access.redhat.com/security/cve/CVE-2026-4111
• report
  https://access.redhat.com/security/cve/CVE-2026-5121
• report
  https://access.redhat.com/security/cve/CVE-2026-5745
• report
  https://access.redhat.com/security/cve/CVE-2026-4426
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8944.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2412648
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-60753
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-60753
• article
  https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753
• article
  https://github.com/libarchive/libarchive/issues/2725
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2446453
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4111
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4111
• article
  https://github.com/libarchive/libarchive/pull/2877
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2449006
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4424
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4424
• article
  https://github.com/libarchive/libarchive/pull/2898
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2449010
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4426
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4426
• article
  https://github.com/libarchive/libarchive/pull/2897
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452945
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-5121
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-5121
• advisory
  https://github.com/advisories/GHSA-2vwv-vqpv-v8vc
• article
  https://github.com/libarchive/libarchive/pull/2934
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2455921
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-5745
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-5745