CVE-2026-5121

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (pz_log2_bs) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (pz_log2_bs) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.(CVE-2026-4424)

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (pz_log2_bs) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.(CVE-2026-4424)

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (pz_log2_bs) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.(CVE-2026-4424)

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (pz_log2_bs) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.(CVE-2026-4424)

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (pz_log2_bs) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424)

• libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing (CVE-2026-5121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424)

• libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing (CVE-2026-5121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-5121 in the libarchive package for Root:Alpine:3.23. Multiple fixed versions available.

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424)
• libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing (CVE-2026-5121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424)
• libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing (CVE-2026-5121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

• Fix CVE-2026-5121: heap buffer overflow in ISO9660 reader via invalid pz_log2_bs value in Rock Ridge ZF extension

• Fix CVE-2026-5121: heap buffer overflow in ISO9660 reader via invalid pz_log2_bs value in Rock Ridge ZF extension

• SECURITY UPDATE: ACLs applied to a symbolic link modified the link target instead
  • debian/patches/CVE-2021-23177.patch: ACLs applied to a symbolic link modified the link target instead
  • CVE-2021-23177
• SECURITY UPDATE: symbolic links followed when changing modes, times, ACLs and flags while extracting an archive
  • debian/patches/CVE-2021-31566.patch: symbolic links followed when changing modes, times, ACLs and flags while extracting an archive
  • CVE-2021-31566
• SECURITY UPDATE: NULL pointer dereference when calloc() fails while allocating a write filter
  • debian/patches/CVE-2022-36227.patch: NULL pointer dereference when calloc() fails while allocating a write filter
  • CVE-2022-36227
• SECURITY UPDATE: integer overflow in the RAR4 reader allowing an oversized memcpy in copy_from_lzss_window()
  • debian/patches/CVE-2024-20696.patch: integer overflow in the RAR4 reader allowing an oversized memcpy in copy_from_lzss_window()
  • CVE-2024-20696
• SECURITY UPDATE: LZSS window size mismatch after a PPMd block in the RAR4 reader allowing an out-of-bounds read
  • debian/patches/CVE-2026-4424.patch: LZSS window size mismatch after a PPMd block in the RAR4 reader allowing an out-of-bounds read
  • CVE-2026-4424
• SECURITY UPDATE: unvalidated zisofs block size exponent in the ISO9660 Rock Ridge ZF parser
  • debian/patches/CVE-2026-5121.patch: unvalidated zisofs block size exponent in the ISO9660 Rock Ridge ZF parser
  • CVE-2026-5121
• SECURITY UPDATE: double free in the RAR4 reader with over 4 billion nodes
  • debian/patches/CVE-2025-5914.patch: double free in the RAR4 reader with over 4 billion nodes
  • CVE-2025-5914
• SECURITY UPDATE: unchecked strftime() return and localtime() NULL dereference in the bsdtar verbose listing
  • debian/patches/CVE-2025-25724.patch: check the strftime() result so a custom locale whose expansion exceeds the 100-byte buffer cannot leave stale content in it, and guard localtime() returning NULL; backports upstream c9bc934e and ecce4674
  • CVE-2025-25724
• Guard the RAR seek cursor before the previous-block lookup
  • debian/patches/rar-guard-seek-cursor.patch: reject a zero cursor in archive_read_format_rar_seek_data() before reading dbo[cursor - 1], which would otherwise underflow; backports upstream e548c994
• Check the ISO9660 ZF entry length before reading its data bytes
  • debian/patches/iso9660-zf-length-check.patch: test data_length before data[0]/data[1] in parse_rockridge_ZF1(), so a zero-length ZF entry cannot be read past the SUSP region bound; backports upstream a9a73c0e

• Rebase onto Oracle 3.1.2-14.0.3.el7_9: take Oracle's CVE-2025-5914, CVE-2026-4424 and CVE-2026-5121 patches in place of ours; keep only the extra CVE-2026-4424 copy_from_lzss_window() bounds check
• Build el7 targets with the .el7_9 dist

• CVE-2021-23177: fix extraction of ACLs to the symlink target instead of the link
• CVE-2021-31566: do not follow symlinks when fixing up permissions and file flags
• CVE-2026-5121: validate pz_log2_bs in the iso9660 zisofs reader

The updated packages fix bugs including security ones.

Double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack(). (CVE-2026-14164) Heap overflow oob read while parsing a tar archive contains a pax extended header. (CVE-2026-15028) A null pointer dereference vulnerability exists in the acl parser of libarchive. (CVE-2026-5745) Reading past eof may be triggered for piped file streams. (CVE-2025-5918) An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash). (CVE-2025-60753) Infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive. (CVE-2026-4111) Information disclosure via heap out-of-bounds read in rar archive processing. (CVE-2026-4424) Denial of service via malformed iso file processing. (CVE-2026-4426) Arbitrary code execution via integer overflow in iso9660 image processing. (CVE-2026-5121)

This update for libarchive fixes the following issues

• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).

This update for libarchive fixes the following issues

• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).

This update for libarchive fixes the following issues

• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).

This update for libarchive fixes the following issues

• CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).

This update for libarchive fixes the following issues

• CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).

This update for libarchive fixes the following issues

• CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).

This update for libarchive fixes the following issues

• CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
• CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
• CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).

This update for libarchive fixes the following issues

• CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
• CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
• CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
• CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).

It was discovered that libarchive incorrectly handled certain RAR archives. An attacker could possibly use this issue to cause an out-of-bounds read via a crafted RAR archive, leading to sensitive memory disclosure. (CVE-2026-4424)

It was discovered that libarchive incorrectly handled certain ISO files. An attacker could possibly use this issue to cause incorrect memory allocation via a crafted ISO file, leading to a denial of service. (CVE-2026-4426)

It was discovered that libarchive incorrectly handled block pointer allocation in zisofs on 32-bit systems. An attacker could possibly use this issue to cause a heap buffer overflow via a crafted ISO9660 image, possibly leading to arbitrary code execution. (CVE-2026-5121)