A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libarchiveUpgrade libarchive-develUpgrade bsdtar | Oct 11, 2026 | Aug 10, 2026 |
| Debian | — | Upgrade libarchive | Sep 1, 2026 | Sep 1, 2026 |
| Oracle_linux | — | Upgrade bsdtarUpgrade libarchive-develUpgrade libarchive | Oct 22, 2026 | Jun 30, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Aug 19, 2026 | May 24, 2026 |
| Redhat_linux | — | Upgrade bsdunzip-debuginfoUpgrade bsdtar-debuginfoUpgrade libarchive-debugsourceUpgrade libarchive-debuginfoUpgrade libarchiveUpgrade libarchive-develUpgrade bsdcat-debuginfoUpgrade bsdtarUpgrade bsdcpio-debuginfo | Jul 17, 2026 | May 24, 2026 |
| Rocky_linux | — | Upgrade bsdtar-debuginfoUpgrade libarchive-debuginfoUpgrade libarchiveUpgrade libarchive-develUpgrade libarchive-debugsourceUpgrade bsdtar | Aug 12, 2026 | Aug 11, 2026 |
| Ubuntu | — | Upgrade libarchive-toolsUpgrade libarchive-tools (Ubuntu Pro)Upgrade libarchive-devUpgrade libarchive13Upgrade libarchive13t64Upgrade libarchive-dev (Ubuntu Pro)Upgrade libarchive13 (Ubuntu Pro) | Jul 22, 2026 | Jul 21, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub