CVE-2026-5745
Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive
A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive
A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).
- Record
CVE-2026-5745- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-06
EUVDEUVD-2026-19705
A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).
- Record
EUVD-2026-19705- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-fjqv-vj6q-4fcm
A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL...
A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).
- Record
GHSA-fjqv-vj6q-4fcm- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).
- Record
CVE-2026-5745- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-5745
A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).
- Record
DEBIAN-CVE-2026-5745- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
OSVRHSA-2026:8944
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:8944- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2026-5745
A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).
- Record
UBUNTU-CVE-2026-5745- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1776429223 No score
libarchive: Fix of CVE-2026-5745
- CVE-2026-5745: fix NULL pointer dereference in ACL parsing in archive_acl_from_text_w()
- Record
CLSA-2026-1776429223- Updated
- 2026-11-02
OSVCLSA-2026-1776430169 No score
libarchive: Fix of CVE-2026-5745
- CVE-2026-5745: fix NULL pointer dereference in ACL parsing in archive_acl_from_text_w()
- Record
CLSA-2026-1776430169- Updated
- 2026-11-02
OSVMGASA-2026-0241 No score
Updated libarchive packages fix security vulnerabilities
The updated packages fix bugs including security ones.
- Record
MGASA-2026-0241- Updated
- 2026-11-02
OSVMGASA-2026-0366 No score
Updated libarchive packages fix security vulnerabilities
Double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack(). (CVE-2026-14164) Heap overflow oob read while parsing a tar archive contains a pax extended header. (CVE-2026-15028) A null pointer dereference vulnerability exists in the acl parser of libarchive. (CVE-2026-5745) Reading past eof may be triggered for piped file streams. (CVE-2025-5918) An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash). (CVE-2025-60753) Infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive. (CVE-2026-4111) Information disclosure via heap out-of-bounds read in rar archive processing. (CVE-2026-4424) Denial of service via malformed iso file processing. (CVE-2026-4426) Arbitrary code execution via integer overflow in iso9660 image processing. (CVE-2026-5121)
- Record
MGASA-2026-0366- Updated
- 2026-11-02
Affected products
- libarchive
- red hat enterprise linux 10
- red hat enterprise linux 6
- red hat enterprise linux 7
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat hardened images
- red hat openshift ai (rhoai)
- red hat openshift container platform 4
- redhat enterprise linux
- redhat hardened images
- redhat openshift container platform
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bsdcatTuxCare:AlmaLinux:9.6 |
before 3.5.3-6.el9_6.tuxcare.els4 | 3.5.3-6.el9_6.tuxcare.els4 |
bsdcpioTuxCare:AlmaLinux:9.6 |
before 3.5.3-6.el9_6.tuxcare.els4 | 3.5.3-6.el9_6.tuxcare.els4 |
bsdtarTuxCare:AlmaLinux:9.6 |
before 3.5.3-6.el9_6.tuxcare.els4 | 3.5.3-6.el9_6.tuxcare.els4 |
libarchiveTuxCare:AlmaLinux:9.6 |
before 3.5.3-6.el9_6.tuxcare.els4 | 3.5.3-6.el9_6.tuxcare.els4 |
libarchive-develTuxCare:AlmaLinux:9.6 |
before 3.5.3-6.el9_6.tuxcare.els4 | 3.5.3-6.el9_6.tuxcare.els4 |
bsdcatTuxCare:AlmaLinux:9.2 |
before 3.5.3-6.el9_2.tuxcare.els4 | 3.5.3-6.el9_2.tuxcare.els4 |
bsdcpioTuxCare:AlmaLinux:9.2 |
before 3.5.3-6.el9_2.tuxcare.els4 | 3.5.3-6.el9_2.tuxcare.els4 |
bsdtarTuxCare:AlmaLinux:9.2 |
before 3.5.3-6.el9_2.tuxcare.els4 | 3.5.3-6.el9_2.tuxcare.els4 |
libarchiveTuxCare:AlmaLinux:9.2 |
before 3.5.3-6.el9_2.tuxcare.els4 | 3.5.3-6.el9_2.tuxcare.els4 |
libarchive-develTuxCare:AlmaLinux:9.2 |
before 3.5.3-6.el9_2.tuxcare.els4 | 3.5.3-6.el9_2.tuxcare.els4 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libarchiveDebian:12 |
All versions, plus listed versions 3.6.2-13.6.2-1+deb12u13.6.2-1+deb12u23.6.2-1+deb12u33.6.2-1+deb12u4 Show 21 moreShow less3.6.2-1+deb12u53.7.2-13.7.2-1.13.7.2-1.1~exp13.7.2-23.7.2-2.13.7.4-13.7.4-1.13.7.4-23.7.4-33.7.4-43.8.10-13.8.10-23.8.11-13.8.4-13.8.5-13.8.6-13.8.7-13.8.8-13.8.8-23.8.9-1 |
None known |
libarchiveDebian:13 |
All versions, plus listed versions 3.7.4-43.7.4-4+deb13u13.8.10-13.8.10-23.8.11-1 Show 7 moreShow less3.8.4-13.8.5-13.8.6-13.8.7-13.8.8-13.8.8-23.8.9-1 |
None known |
libarchiveDebian:14 |
before 3.8.8-1, plus listed versions 3.7.4-43.8.4-13.8.5-13.8.6-13.8.7-1 |
3.8.8-1 |
libarchiveMageia:10 From an advisory covering 6 CVEs |
before 3.8.8-1.mga10 | 3.8.8-1.mga10 |
libarchiveMageia:10 From an advisory covering 9 CVEs |
before 3.8.9-1.mga10 | 3.8.9-1.mga10 |
libarchiveMageia:9 From an advisory covering 9 CVEs |
before 3.6.2-5.6.mga9 | 3.6.2-5.6.mga9 |
libarchiveRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.8.7-1.hum1 | 0:3.8.7-1.hum1 |
libarchive-develRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.8.7-1.hum1 | 0:3.8.7-1.hum1 |
libarchiveUbuntu:Pro:20.04:LTS |
before 3.4.0-2ubuntu1.5+esm3, plus listed versions 3.4.0-13.4.0-1build13.4.0-1ubuntu23.4.0-2ubuntu13.4.0-2ubuntu1.1 Show 6 moreShow less3.4.0-2ubuntu1.23.4.0-2ubuntu1.33.4.0-2ubuntu1.43.4.0-2ubuntu1.53.4.0-2ubuntu1.5+esm13.4.0-2ubuntu1.5+esm2 |
3.4.0-2ubuntu1.5+esm3 |
libarchiveUbuntu:22.04:LTS |
before 3.6.0-1ubuntu1.8, plus listed versions 3.4.3-23.4.3-2build13.5.2-13.5.2-1ubuntu13.6.0-1ubuntu1 Show 7 moreShow less3.6.0-1ubuntu1.13.6.0-1ubuntu1.23.6.0-1ubuntu1.33.6.0-1ubuntu1.43.6.0-1ubuntu1.53.6.0-1ubuntu1.63.6.0-1ubuntu1.7 |
3.6.0-1ubuntu1.8 |
libarchiveUbuntu:24.04:LTS |
before 3.7.2-2ubuntu0.8, plus listed versions 3.6.2-1ubuntu13.7.2-1ubuntu13.7.2-1ubuntu23.7.2-1.1ubuntu23.7.2-2 Show 7 moreShow less3.7.2-2ubuntu0.13.7.2-2ubuntu0.23.7.2-2ubuntu0.33.7.2-2ubuntu0.43.7.2-2ubuntu0.53.7.2-2ubuntu0.63.7.2-2ubuntu0.7 |
3.7.2-2ubuntu0.8 |
libarchiveUbuntu:25.10 |
All versions, plus listed versions 3.7.7-0ubuntu23.7.7-0ubuntu2.13.7.7-0ubuntu2.23.7.7-0ubuntu33.7.7-0ubuntu3.13.7.7-0ubuntu3.2 |
None known |
libarchiveUbuntu:26.04:LTS |
before 3.8.5-1ubuntu2.2, plus listed versions 3.7.7-0ubuntu33.8.5-1ubuntu13.8.5-1ubuntu23.8.5-1ubuntu2.1 |
3.8.5-1ubuntu2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | NVD, OSV | |
| affected, products | CVE List, EUVD, NVD | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-5745 is a medium vulnerability (CVSS 5.5) in Libarchive, published April 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 5th percentile. Fixed in bsdcat 3.5.3-6.el9_6.tuxcare.els4.
References
access.redhat.com/errata/RHSA-2026:8944
bugzilla.redhat.com/show_bug.cgi?id=2455921
nvd.nist.gov/vuln/detail/CVE-2026-5745
github.com/advisories/GHSA-fjqv-vj6q-4fcm
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1776429223.html
Show 40 moreShow less
security-tracker.debian.org/tracker/CVE-2026-5745
advisories.mageia.org/MGASA-2026-0241.html
bugs.mageia.org/show_bug.cgi?id=35836
ubuntu.com/security/notices/USN-8581-1
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8944.json
cve.org/CVERecord?id=CVE-2025-60753