OESA-2026-1943 (CVE-2026-4424)

Vulnerability from osv_openeuler – Published: 2026-04-17 11:10 – Updated: 2026-08-06 11:10 – Source website
VLAI
Summary
libarchive security update
Details

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.(CVE-2026-4424)

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (pz_log2_bs) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "bsdcat-3.7.1-11.oe2403sp1.aarch64.rpm",
          "bsdcpio-3.7.1-11.oe2403sp1.aarch64.rpm",
          "bsdtar-3.7.1-11.oe2403sp1.aarch64.rpm",
          "bsdunzip-3.7.1-11.oe2403sp1.aarch64.rpm",
          "libarchive-3.7.1-11.oe2403sp1.aarch64.rpm",
          "libarchive-debuginfo-3.7.1-11.oe2403sp1.aarch64.rpm",
          "libarchive-debugsource-3.7.1-11.oe2403sp1.aarch64.rpm",
          "libarchive-devel-3.7.1-11.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "libarchive-help-3.7.1-11.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "libarchive-3.7.1-11.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "bsdcat-3.7.1-11.oe2403sp1.x86_64.rpm",
          "bsdcpio-3.7.1-11.oe2403sp1.x86_64.rpm",
          "bsdtar-3.7.1-11.oe2403sp1.x86_64.rpm",
          "bsdunzip-3.7.1-11.oe2403sp1.x86_64.rpm",
          "libarchive-3.7.1-11.oe2403sp1.x86_64.rpm",
          "libarchive-debuginfo-3.7.1-11.oe2403sp1.x86_64.rpm",
          "libarchive-debugsource-3.7.1-11.oe2403sp1.x86_64.rpm",
          "libarchive-devel-3.7.1-11.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "libarchive",
        "purl": "pkg:rpm/openEuler/libarchive\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.1-11.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.(CVE-2026-4424)\n\nA flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)\n\nA flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)",
  "id": "OESA-2026-1943",
  "modified": "2026-08-06T11:10:57Z",
  "published": "2026-04-17T11:10:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1943"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4424"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4426"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5121"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libarchive security update",
  "upstream": [
    "CVE-2026-4424",
    "CVE-2026-4426",
    "CVE-2026-5121"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.