Skip to content
OpenAdvisories

Description

A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Hardened Images — —
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat OpenShift AI (RHOAI) — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libarchive 3.8.9-1 —
Debian 13 libarchive No fix yet —
Debian 12 libarchive No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS libarchive No fix yet —
Ubuntu 24.04 LTS libarchive No fix yet —
Ubuntu 22.04 LTS libarchive No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libarchive No fix yet —
Ubuntu Pro 18.04 LTS libarchive No fix yet —
Ubuntu Pro 16.04 LTS libarchive No fix yet —
Ubuntu Pro 14.04 LTS libarchive No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 bsdcat +5 3.8.9-2.1.hum1 RHSA-2026:77775

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 cmake +1 No fix yet —

Advisories 2

References