{"id":"CVE-2026-14164","aliases":["ALSA-2026:52674","ALSA-2026:52675","AZL-91713","BELL-CVE-2026-14164","DEBIAN-CVE-2026-14164","EUVD-2026-40259","GHSA-xq96-f7x8-gfx3","MGASA-2026-0366","OESA-2026-2887","OESA-2026-2888","OESA-2026-2889","OESA-2026-2890","OESA-2026-3040","RHSA-2026:30333","RHSA-2026:52674","RHSA-2026:52675","RHSA-2026:56954","RHSA-2026:58558","RHSA-2026:58573","RHSA-2026:58574","RLSA-2026:52674","RLSA-2026:52675","UBUNTU-CVE-2026-14164","USN-8581-1"],"status":"published","title":"Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()","description":"A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00792,"percentile":0.56772,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2026-06-30T06:29:23Z","modified":"2026-11-07T10:01:05Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"bsdtar","fixed_in":["3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libarchive","fixed_in":["3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libarchive-devel","fixed_in":["3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"bsdtar","fixed_in":["3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libarchive","fixed_in":["3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libarchive-devel","fixed_in":["3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libarchive","fixed_in":["3.7.7-7"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libarchive","fixed_in":["3.8.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libarchive","fixed_in":["3.8.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libarchive","fixed_in":["3.8.8-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libarchive","fixed_in":["3.6.2-1+deb12u5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libarchive","fixed_in":["3.8.8-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libarchive","fixed_in":["3.4.3-15.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libarchive","fixed_in":["3.5.2-14.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libarchive","fixed_in":["3.7.1-12.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libarchive","fixed_in":["3.7.1-12.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"libarchive","fixed_in":["3.7.1-12.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"bsdcat","fixed_in":["0:3.8.8-2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"bsdcpio","fixed_in":["0:3.8.8-2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"bsdtar","fixed_in":["0:3.8.8-2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"bsdunzip","fixed_in":["0:3.8.8-2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libarchive","fixed_in":["0:3.8.8-2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libarchive-devel","fixed_in":["0:3.8.8-2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debugsource","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-devel","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debugsource","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"bsdcat-debuginfo","fixed_in":["0:3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"bsdcpio-debuginfo","fixed_in":["0:3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"bsdtar","fixed_in":["0:3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"bsdtar-debuginfo","fixed_in":["0:3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"bsdunzip-debuginfo","fixed_in":["0:3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libarchive-debuginfo","fixed_in":["0:3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libarchive-debugsource","fixed_in":["0:3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libarchive-devel","fixed_in":["0:3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libarchive","fixed_in":["0:3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdcat-debuginfo","fixed_in":["0:3.7.7-5.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdcpio-debuginfo","fixed_in":["0:3.7.7-5.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdtar","fixed_in":["0:3.7.7-5.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdtar-debuginfo","fixed_in":["0:3.7.7-5.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdunzip-debuginfo","fixed_in":["0:3.7.7-5.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libarchive-debuginfo","fixed_in":["0:3.7.7-5.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libarchive-debugsource","fixed_in":["0:3.7.7-5.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libarchive-devel","fixed_in":["0:3.7.7-5.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libarchive","fixed_in":["0:3.7.7-5.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdtar","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-debugsource","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-devel","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive-debugsource","fixed_in":["0:3.5.3-7.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdtar","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libarchive-debugsource","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libarchive-devel","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libarchive","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libarchive-debugsource","fixed_in":["0:3.5.3-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-5.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-5.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdtar","fixed_in":["0:3.5.3-5.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-5.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-5.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libarchive-debugsource","fixed_in":["0:3.5.3-5.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-5.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-5.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-5.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive","fixed_in":["0:3.5.3-5.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-5.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive-debugsource","fixed_in":["0:3.5.3-5.el9_2.3"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"libarchive","fixed_in":["0:3.5.3-11.el9_8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"libarchive","fixed_in":["0:3.7.7-10.el10_2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libarchive","fixed_in":["3.4.0-2ubuntu1.5+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","fixed_in":["3.6.0-1ubuntu1.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","fixed_in":["3.7.2-2ubuntu0.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libarchive","fixed_in":["3.8.5-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-7"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.1-r1"},{"fixed":"3.8.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.0-r0"},{"fixed":"3.8.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.2-r1"},{"fixed":"3.8.8-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1+deb12u5"}]}],"versions":["3.6.2-1","3.6.2-1+deb12u1","3.6.2-1+deb12u2","3.6.2-1+deb12u3","3.6.2-1+deb12u4"]},{"source":"osv","ecosystem":"Debian:13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.4-4","3.7.4-4+deb13u1","3.8.10-1","3.8.10-2","3.8.11-1","3.8.4-1","3.8.5-1","3.8.6-1","3.8.7-1","3.8.8-1","3.8.8-2","3.8.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.8-1"}]}],"versions":["3.7.4-4","3.8.4-1","3.8.5-1","3.8.6-1","3.8.7-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-1.mga10"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-5.6.mga9"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-15.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-14.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-12.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-12.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-12.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bsdcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.8-2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.8-2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.8-2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bsdunzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.8-2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.8-2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.8-2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"bsdunzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"bsdunzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-5.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.3"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-11.el9_8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-10.el10_2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.5+esm3"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2","3.4.0-2ubuntu1.3","3.4.0-2ubuntu1.4","3.4.0-2ubuntu1.5","3.4.0-2ubuntu1.5+esm1","3.4.0-2ubuntu1.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.8"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1","3.6.0-1ubuntu1.2","3.6.0-1ubuntu1.3","3.6.0-1ubuntu1.4","3.6.0-1ubuntu1.5","3.6.0-1ubuntu1.6","3.6.0-1ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.8"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1","3.7.2-2ubuntu0.2","3.7.2-2ubuntu0.3","3.7.2-2ubuntu0.4","3.7.2-2ubuntu0.5","3.7.2-2ubuntu0.6","3.7.2-2ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.7-0ubuntu2","3.7.7-0ubuntu2.1","3.7.7-0ubuntu2.2","3.7.7-0ubuntu3","3.7.7-0ubuntu3.1","3.7.7-0ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.5-1ubuntu2.2"}]}],"versions":["3.7.7-0ubuntu3","3.8.5-1ubuntu1","3.8.5-1ubuntu2","3.8.5-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.5+esm3"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2","3.4.0-2ubuntu1.3","3.4.0-2ubuntu1.4","3.4.0-2ubuntu1.5","3.4.0-2ubuntu1.5+esm1","3.4.0-2ubuntu1.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.8"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1","3.6.0-1ubuntu1.2","3.6.0-1ubuntu1.3","3.6.0-1ubuntu1.4","3.6.0-1ubuntu1.5","3.6.0-1ubuntu1.6","3.6.0-1ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.8"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1","3.7.2-2ubuntu0.2","3.7.2-2ubuntu0.3","3.7.2-2ubuntu0.4","3.7.2-2ubuntu0.5","3.7.2-2ubuntu0.6","3.7.2-2ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.5-1ubuntu2.2"}]}],"versions":["3.7.7-0ubuntu3","3.8.5-1ubuntu1","3.8.5-1ubuntu2","3.8.5-1ubuntu2.1"]}],"products":[{"vendor":"red hat","product":"cert manager support for red hat openshift release 1.17"},{"vendor":"red hat","product":"cert manager support for red hat openshift release 1.18"},{"vendor":"red hat","product":"cert manager support for red hat openshift release 1.20"},{"vendor":"red hat","product":"red hat ai inference server 3.5"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 3.0"},{"vendor":"red hat","product":"red hat openshift ai 3.2"},{"vendor":"red hat","product":"red hat openshift ai 3.4"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"red hat","product":"red hat openshift container platform 4.15"},{"vendor":"red hat","product":"red hat openshift container platform 4.16"},{"vendor":"red hat","product":"red hat openshift container platform 4.17"},{"vendor":"red hat","product":"red hat openshift container platform 4.18"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat openshift container platform 4.20"},{"vendor":"red hat","product":"red hat openshift container platform 4.21"},{"vendor":"red hat","product":"red hat openshift container platform 4.22"},{"vendor":"red hat","product":"red hat openshift container platform 5"},{"vendor":"red hat","product":"red hat update infrastructure 5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:30333","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52674","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52675","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54387","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54760","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54769","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56954","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58558","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58573","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58574","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58981","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61783","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62409","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63041","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63044","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63100","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65839","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65851","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67857","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67935","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70586","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70615","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72394","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72395","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72399","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72470","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72475","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72476","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72502","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73909","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73959","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73960","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73961","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73962","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74458","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74459","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74460","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74461","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74462","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74463","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74674","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82061","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82304","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82322","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82336","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82347","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82354","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82371","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82372","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82857","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82888","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14164","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493411","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/libarchive/libarchive/issues/3069","tags":["exploit","article"]},{"url":"https://github.com/libarchive/libarchive/pull/3071","tags":["article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14164","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xq96-f7x8-gfx3"},{"url":"https://bugzilla.redhat.com/2493411","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-52674.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-52675.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-14164","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-14164","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0366.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35999","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8581-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2887","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2888","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2889","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2890","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3040","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30333.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14164","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52674.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52675.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56954.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58558.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58573.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58574.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:52674","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:52675","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-14164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-5745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-15028","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-14164","title":"Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()","description":"A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.","status":"published","published":"2026-06-30T06:29:23.549Z","modified":"2026-11-06T07:39:30.421Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-415"],"updated_at":"2026-11-06T08:57:32.08691Z"}],"euvd":[{"id":"EUVD-2026-40259","description":"A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.","status":"published","published":"2026-06-30T06:29:23Z","modified":"2026-11-06T07:39:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T09:04:28.113071Z"}],"ghsa":[{"id":"GHSA-xq96-f7x8-gfx3","title":"A double free issue has been identified in libarchive's RAR5 reader. During parsing of a...","description":"A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.","status":"published","published":"2026-06-30T09:31:35Z","modified":"2026-10-14T21:32:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T15:13:28.606179Z"}],"nvd":[{"id":"CVE-2026-14164","description":"A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.","status":"published","published":"2026-06-30T07:16:32.17Z","modified":"2026-11-06T08:17:21.963Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-415"],"updated_at":"2026-11-06T11:59:56.337908Z"}],"osv":[{"id":"BELL-CVE-2026-14164","status":"published","published":"2026-07-01T06:03:04.91844Z","modified":"2026-07-10T07:15:04.661753558Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"DEBIAN-CVE-2026-14164","description":"A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.","status":"published","published":"2026-06-30T07:16:32.17Z","modified":"2026-11-07T10:01:05.108441443Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-07T10:14:19.880839Z"},{"id":"OESA-2026-2887","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA double free issue has been identified in libarchive\u0026apos;s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.(CVE-2026-14164)","status":"published","published":"2026-07-09T11:11:47Z","modified":"2026-08-18T01:21:14.545035182Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2888","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA double free issue has been identified in libarchive\u0026apos;s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.(CVE-2026-14164)","status":"published","published":"2026-07-09T11:11:47Z","modified":"2026-08-18T01:21:15.196704187Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2889","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA double free issue has been identified in libarchive\u0026apos;s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.(CVE-2026-14164)","status":"published","published":"2026-07-09T11:11:48Z","modified":"2026-08-18T01:21:15.219345651Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2890","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA double free issue has been identified in libarchive\u0026apos;s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.(CVE-2026-14164)","status":"published","published":"2026-07-09T11:11:48Z","modified":"2026-08-18T01:21:15.107320961Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3040","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA double free issue has been identified in libarchive\u0026apos;s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.(CVE-2026-14164)","status":"published","published":"2026-07-19T11:11:56Z","modified":"2026-08-18T01:21:18.683455219Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:30333","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-01T10:18:46Z","modified":"2026-10-15T10:16:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:52674","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-08-10T10:13:38Z","modified":"2026-10-15T10:21:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:52675","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-08-10T10:13:38Z","modified":"2026-10-15T10:21:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:56954","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-08-20T10:19:56Z","modified":"2026-10-15T10:21:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:58558","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-08-24T10:18:40Z","modified":"2026-10-15T10:22:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:58573","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-08-24T10:18:46Z","modified":"2026-10-15T10:22:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:58574","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-08-24T10:18:47Z","modified":"2026-10-15T10:22:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:52674","title":"Moderate: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-11T06:03:54.025898Z","modified":"2026-08-11T06:30:07.933443682Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:52675","title":"Moderate: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-11T12:06:19.514407Z","modified":"2026-08-11T12:30:03.324404469Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-14164","description":"A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.","status":"published","published":"2026-06-30T07:16:00Z","modified":"2026-07-23T01:15:17.566160136Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"ALSA-2026:52674","title":"Moderate: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.  \n\nSecurity Fix(es):  \n\n  * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-10T00:00:00Z","modified":"2026-10-29T11:32:36.437311205Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:52675","title":"Moderate: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.  \n\nSecurity Fix(es):  \n\n  * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-10T00:00:00Z","modified":"2026-10-29T11:30:38.467474321Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-91713","title":"CVE-2026-14164 affecting package libarchive for versions less than 3.7.7-7","description":"A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.","status":"published","published":"2026-06-30T07:16:32Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"MGASA-2026-0366","title":"Updated libarchive packages fix security vulnerabilities","description":"Double-free vulnerability in rar5 decompression logic via dangling\nfiltered_buf pointer in init_unpack(). (CVE-2026-14164)\nHeap overflow oob read while parsing a tar archive contains a pax\nextended header. (CVE-2026-15028)\nA null pointer dereference vulnerability exists in the acl parser of\nlibarchive. (CVE-2026-5745)\nReading past eof may be triggered for piped file streams.\n(CVE-2025-5918)\nAn issue was discovered in libarchive bsdtar before version 3.8.1 in\nfunction apply_substitution in file tar/subst.c when processing crafted\n-s substitution rules. This can cause unbounded memory allocation and\nlead to denial of service (Out-of-Memory crash). (CVE-2025-60753)\nInfinite loop denial of service in rar5 decompression via\narchive_read_data() in libarchive. (CVE-2026-4111)\nInformation disclosure via heap out-of-bounds read in rar archive\nprocessing. (CVE-2026-4424)\nDenial of service via malformed iso file processing. (CVE-2026-4426)\nArbitrary code execution via integer overflow in iso9660 image\nprocessing. (CVE-2026-5121)\n","status":"published","published":"2026-09-02T16:59:28Z","modified":"2026-09-02T17:11:17.793563615Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8581-1","title":"libarchive vulnerabilities","description":"It was discovered that libarchive did not properly manage memory when\nunpacking certain RAR5 archives, leading to a double free. An attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2026-14164)\n\nIt was discovered that libarchive did not properly validate certain tar\narchives, leading to a buffer overflow. A remote attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary code.\nThis issue only affected Ubuntu 26.04 LTS. (CVE-2026-15028)\n\nIt was discovered that libarchive did not properly validate certain\nmalformed ACL entries. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2026-5745)","status":"published","published":"2026-07-21T17:34:42Z","modified":"2026-07-23T01:29:27.939870945Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}