Description
A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.20 | — | — |
| Red Hat | Red Hat AI Inference Server 3.5 | — | — |
| Red Hat | Red Hat Discovery 2 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI 3.0 | — | — |
| Red Hat | Red Hat OpenShift AI 3.2 | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat Update Infrastructure 5 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libarchive | 3.8.8-1 | — |
| Debian 13 | libarchive | No fix yet | — |
| Debian 12 | libarchive | 3.6.2-1+deb12u5 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | libarchive | 3.8.5-1ubuntu2.2 | — |
| Ubuntu 25.10 | libarchive | No fix yet | — |
| Ubuntu 24.04 LTS | libarchive | 3.7.2-2ubuntu0.8 | — |
| Ubuntu 22.04 LTS | libarchive | 3.6.0-1ubuntu1.8 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libarchive | 3.4.0-2ubuntu1.5+esm3 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | bsdtar +2 | 3.7.7-10.el10_2 | RHSA-2026:52675 |
| RHEL 9 | bsdtar +2 | 3.5.3-11.el9_8 | RHSA-2026:52674 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | bsdtar +2 | 3.7.7-5.el10_0.1 | RHSA-2026:56954 |
| RHEL 9.6 EUS | bsdtar +2 | 3.5.3-7.el9_6.2 | RHSA-2026:58558 |
| RHEL 9.4 E4S | bsdtar +2 | 3.5.3-5.el9_4.2 | RHSA-2026:58573 |
| RHEL 9.2 E4S | bsdtar +1 | 3.5.3-5.el9_2.3 | RHSA-2026:58574 |
| Red Hat Hardened Images 1 | bsdcat +5 | 3.8.8-2.hum1 | RHSA-2026:30333 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | bsdtar +2 | 3.7.7-10.el10_2 | ALSA-2026:52675 |
| AlmaLinux 9 | bsdtar +2 | 3.5.3-11.el9_8 | ALSA-2026:52674 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libarchive | 3.7.7-10.el10_2 | RLSA-2026:52675 |
| Rocky Linux 9 | libarchive | 3.5.3-11.el9_8 | RLSA-2026:52674 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libarchive | 3.7.7-7 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | bsdtar +2 | 3.7.7-10.el10_2 | ELSA-2026-52675 |
| Oracle Linux 9 | bsdtar +2 | 3.5.3-11.el9_8 | ELSA-2026-52674 |
Advisories 14
- ALSA-2026:52674 Moderate: libarchive security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:52675 Moderate: libarchive security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:58574 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:58573 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:58558 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:56954 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:52674 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:52675 Red Hat Security Advisory: libarchive security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:30333 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2026-2710 libarchive: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 14, 2026
- RLSA-2026:52675 Moderate: libarchive security update Rocky Linux Security Advisories · Aug 11, 2026
- RLSA-2026:52674 Moderate: libarchive security update Rocky Linux Security Advisories · Aug 11, 2026
- ELSA-2026-52675 Moderate: libarchive security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 10, 2026
- ELSA-2026-52674 Moderate: libarchive security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 10, 2026
References
- RHSA-2026:30333 vendor-advisory
- RHSA-2026:52674 vendor-advisory
- RHSA-2026:52675 vendor-advisory
- RHSA-2026:54387 vendor-advisory
- RHSA-2026:54760 vendor-advisory
- RHSA-2026:54769 vendor-advisory
- RHSA-2026:56954 vendor-advisory
- RHSA-2026:58558 vendor-advisory
- RHSA-2026:58573 vendor-advisory
- RHSA-2026:58574 vendor-advisory
- RHSA-2026:58981 vendor-advisory
- RHSA-2026:61783 vendor-advisory
- RHSA-2026:62409 vendor-advisory
- RHSA-2026:63041 vendor-advisory
- RHSA-2026:63044 vendor-advisory
- RHSA-2026:63100 vendor-advisory
- RHSA-2026:65839 vendor-advisory
- RHSA-2026:65851 vendor-advisory
- RHSA-2026:67857 vendor-advisory
- RHSA-2026:67935 vendor-advisory
- RHSA-2026:70586 vendor-advisory
- RHSA-2026:70615 vendor-advisory
- RHSA-2026:72394 vendor-advisory
- RHSA-2026:72395 vendor-advisory
- RHSA-2026:72399 vendor-advisory
- RHSA-2026:72470 vendor-advisory
- RHSA-2026:72475 vendor-advisory
- RHSA-2026:72476 vendor-advisory
- RHSA-2026:72502 vendor-advisory
- RHSA-2026:73909 vendor-advisory
- RHSA-2026:73959 vendor-advisory
- RHSA-2026:73960 vendor-advisory
- RHSA-2026:73961 vendor-advisory
- RHSA-2026:73962 vendor-advisory
- RHSA-2026:74458 vendor-advisory
- RHSA-2026:74459 vendor-advisory
- RHSA-2026:74460 vendor-advisory
- RHSA-2026:74461 vendor-advisory
- RHSA-2026:74462 vendor-advisory
- RHSA-2026:74463 vendor-advisory
- RHSA-2026:74674 vendor-advisory
- RHSA-2026:82061 vendor-advisory
- RHSA-2026:82304 vendor-advisory
- RHSA-2026:82322 vendor-advisory
- RHSA-2026:82336 vendor-advisory
- RHSA-2026:82347 vendor-advisory
- RHSA-2026:82354 vendor-advisory
- RHSA-2026:82371 vendor-advisory
- RHSA-2026:82372 vendor-advisory
- RHSA-2026:82857 vendor-advisory
- RHSA-2026:82888 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-14164 vdb-entry
- RHBZ#2493411 issue-tracking
- https://github.com/libarchive/libarchive/issues/3069
- https://github.com/libarchive/libarchive/pull/3071