Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat libarchive can let attackers run code

published 2 months ago

Summary

Systems that use Red Hat Enterprise Linux include a component called libarchive for opening zip and tar files. A flaw in this component could allow a maliciously crafted archive to execute unwanted code on the server, potentially giving attackers control. Install the latest Red Hat security update as soon as possible to close the gap.

What to do

Update redhat bsdcat-debuginfo to version 0:3.5.3-5.el9_4.2.
Update redhat bsdcpio-debuginfo to version 0:3.5.3-5.el9_4.2.
Update redhat bsdtar to version 0:3.5.3-5.el9_4.2.
Update redhat bsdtar-debuginfo to version 0:3.5.3-5.el9_4.2.
Update redhat libarchive-debuginfo to version 0:3.5.3-5.el9_4.2.
Update redhat libarchive-debugsource to version 0:3.5.3-5.el9_4.2.
Update redhat libarchive-devel to version 0:3.5.3-5.el9_4.2.
Update redhat libarchive to version 0:3.5.3-5.el9_4.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:9.4::appstream	redhat	bsdcat-debuginfo	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2
Red Hat:rhel_e4s:9.4::appstream	redhat	bsdcpio-debuginfo	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2
Red Hat:rhel_e4s:9.4::appstream	redhat	bsdtar	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2
Red Hat:rhel_e4s:9.4::appstream	redhat	bsdtar-debuginfo	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2
Red Hat:rhel_e4s:9.4::appstream	redhat	libarchive-debuginfo	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2
Red Hat:rhel_e4s:9.4::appstream	redhat	libarchive-debugsource	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2
Red Hat:rhel_e4s:9.4::appstream	redhat	libarchive-devel	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2
Red Hat:rhel_e4s:9.4::baseos	redhat	bsdcat-debuginfo	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2
Red Hat:rhel_e4s:9.4::baseos	redhat	bsdcpio-debuginfo	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2
Red Hat:rhel_e4s:9.4::baseos	redhat	bsdtar-debuginfo	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2
Red Hat:rhel_e4s:9.4::baseos	redhat	libarchive	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2
Red Hat:rhel_e4s:9.4::baseos	redhat	libarchive-debuginfo	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2
Red Hat:rhel_e4s:9.4::baseos	redhat	libarchive-debugsource	< 0:3.5.3-5.el9_4.2 Fix: upgrade to 0:3.5.3-5.el9_4.2

Original advisory text

Red Hat Security Advisory: libarchive security update

References

https://access.redhat.com/errata/RHSA-2026:58573 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2493411 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58573.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-14164 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-14164 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-14164 Vendor Advisory
https://github.com/libarchive/libarchive/issues/3069 Third Party Advisory
https://github.com/libarchive/libarchive/pull/3071 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published24 Aug 2026

Updated27 Aug 2026

First seen27 Aug 2026

Sources

RHSA-2026:58573 · OSV

Track software like this

Free during beta