Summary
It was discovered that libarchive did not properly manage memory when
unpacking certain RAR5 archives, leading to a double free. An attacker
could possibly use this issue to cause a denial of service.
(CVE-2026-14164)
It was discovered that libarchive did not properly validate certain tar
archives, leading to a buffer overflow. A remote attacker could possibly
use this issue to cause a denial of service or execute arbitrary code.
This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15028)
It was discovered that libarchive did not properly validate certain
malformed ACL entries. An attacker could possibly use this issue to cause a
denial of service. (CVE-2026-5745)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libarchive | 3.6.0-1ubuntu1.8 |
| Ubuntu · 24.04 LTS 24.04:LTS | libarchive | 3.7.2-2ubuntu0.8 |
| Ubuntu · 26.04 LTS 26.04:LTS | libarchive | 3.8.5-1ubuntu2.2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libarchive | 3.4.0-2ubuntu1.5+esm3 |