Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-08T10:10:00 libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.

A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.

Conditions for Exploitation: Successful exploitation requires user interaction or a specific application workflow. An attacker cannot trigger this flaw entirely on their own remotely; they must supply a specially crafted tar archive and rely on a user or an automated system (such as an antivirus scanner or file extraction tool) to actively parse it using the libarchive library. Impact Limitations: Although the heap overflow has the potential to allow for arbitrary code execution, achieving this reliably is typically complex and highly dependent on the memory layout and protections of the specific application utilizing the library. In most common scenarios, the malformed archive will simply cause the parsing application to crash, resulting in a localized Denial of Service (DoS) rather than a full system compromise. To mitigate this issue, avoid processing untrusted or unverified tar archives. Users should exercise caution when handling archives from unknown sources or those with unexpected content, as processing a specially crafted archive could trigger the vulnerability. Red Hat Hardened Images 2026-07-12T00:00:00Z RHSA-2026:38279 libarchive-main-3.8.8-2.1.hum1 Red Hat Enterprise Linux 10 Fix deferred libarchive Red Hat Enterprise Linux 6 Out of support scope libarchive Red Hat Enterprise Linux 7 Out of support scope libarchive Red Hat Enterprise Linux 8 Fix deferred libarchive Red Hat Enterprise Linux 9 Fix deferred libarchive Red Hat OpenShift Container Platform 4 Fix deferred rhcos https://www.cve.org/CVERecord?id=CVE-2026-15028 https://nvd.nist.gov/vuln/detail/CVE-2026-15028 https://github.com/libarchive/libarchive/issues/3251 https://github.com/libarchive/libarchive/pull/3253