CVE-2026-15028
Description
A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.
Statement
Conditions for Exploitation: Successful exploitation requires user interaction or a specific application workflow. An attacker cannot trigger this flaw entirely on their own remotely; they must supply a specially crafted tar archive and rely on a user or an automated system (such as an antivirus scanner or file extraction tool) to actively parse it using the libarchive library.
Impact Limitations: Although the heap overflow has the potential to allow for arbitrary code execution, achieving this reliably is typically complex and highly dependent on the memory layout and protections of the specific application utilizing the library. In most common scenarios, the malformed archive will simply cause the parsing application to crash, resulting in a localized Denial of Service (DoS) rather than a full system compromise.
Mitigation
To mitigate this issue, avoid processing untrusted or unverified tar archives. Users should exercise caution when handling archives from unknown sources or those with unexpected content, as processing a specially crafted archive could trigger the vulnerability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.9 | N/A | 3.9 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
