Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.6

libarchive can crash or expose data via mac metadata

CVE-2026-17591 · published 2 days ago
Summary

The libarchive library used in Debian and Red Hat (including hardened images and RHEL 6, 7, and 10) may crash or leak information when processing certain Mac metadata. An attacker who can provide a crafted archive can make the program stop working or read leftover memory contents. Update libarchive to the latest version provided by your distribution or apply the vendor’s security patch as soon as possible.

What to do
  • Update debian libarchive to version 3.8.9-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian libarchive All versions
Debian:14 debian libarchive < 3.8.9-1
Fix: upgrade to 3.8.9-1
– red hat red hat hardened images All versions
– red hat red hat enterprise linux 10 All versions
– red hat red hat enterprise linux 6 All versions
– red hat red hat enterprise linux 7 All versions
– red hat red hat enterprise linux 8 All versions
– red hat red hat enterprise linux 9 All versions
Original advisory text
Libarchive: libarchive: use-after-free via aliased mac metadata copy
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
3.6 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published16 Oct 2026
Updated17 Oct 2026
First seen16 Oct 2026
Sources
CVE-2026-17591 · NVD
DEBIAN-CVE-2026-17591 · OSV
CVE-2026-17591 · MITRE
Track software like this
Free during beta