SUSE-SU-2026:23275-1
Security update for libarchive
No scoreFix available
SUSE-SU-2026:23275-1 is a vulnerability with no CVSS score yet in libarchive, published August 24, 2026. No source lists public exploit code. Fixed in libarchive 3.8.1-160000.4.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.8.1-160000.4.1libarchive
Description
This update for libarchive fixes the following issues:
- Fix creation of temporary files in target directory (bsc#1254340)
- Fix out-of-bounds buffer overrun when using p[H_LEVEL_OFFSET] (bsc#1254341)
- Fix buffer overrun in archive_le32dec when reading truncated 7zip headers (bsc#1254342)
- Fix NULL pointer dereference in archive_acl_from_text_w() (bsc#1260998)
- Fix SEGV in check_7zip_header_in_sfx via ELF offset validation (bsc#1260999)
- Fix out-of-bounds access on ELF 64-bit header (bsc#1261000)
- Fix RAR5 memory leak with many filters (bsc#1261002)
- Fix file descriptor leak in mtree parser cleanup (bsc#1261003)
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libarchiveSUSE:Linux Micro 6.2 | before 3.8.1-160000.4.1 | 3.8.1-160000.4.1 |
What each source reports
OSVNo score
Security update for libarchive
This update for libarchive fixes the following issues:
- Fix creation of temporary files in target directory (bsc#1254340)
- Fix out-of-bounds buffer overrun when using p[H_LEVEL_OFFSET] (bsc#1254341)
- Fix buffer overrun in archive_le32dec when reading truncated 7zip headers (bsc#1254342)
- Fix NULL pointer dereference in archive_acl_from_text_w() (bsc#1260998)
- Fix SEGV in check_7zip_header_in_sfx via ELF offset validation (bsc#1260999)
- Fix out-of-bounds access on ELF 64-bit header (bsc#1261000)
- Fix RAR5 memory leak with many filters (bsc#1261002)
- Fix file descriptor leak in mtree parser cleanup (bsc#1261003)
- Record
SUSE-SU-2026:23275-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.