Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Azure libarchive before 3.7.7‑7 can be crashed or hijacked
published 3 months ago
Summary
The libarchive component used in Azure can be tricked by a specially crafted tar file into overflowing its memory. This could cause the service to stop working or let an attacker run their own code on the system. Update libarchive to version 3.7.7‑7 or later, or apply the vendor's security patch, to stop the risk.
What to do
- Update azure libarchive to version 3.7.7-7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | libarchive |
< 3.7.7-7 Fix: upgrade to 3.7.7-7
|
Original advisory text
CVE-2026-15028 affecting package libarchive for versions less than 3.7.7-7
A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.
References
Timeline
Published10 Jul 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-92331 · OSV
Track software like this
Free during beta