CVE-2026-15028
LowCVSS 3.9Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A flaw was found in libarchive that allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to denial of service or potentially arbitrary code execution.
Risk Assessment
For the organization, the risk includes potential system unavailability (DoS) or attacker takeover of the affected system, which could result in data loss or infrastructure integrity compromise.
Recommendation
Immediately update libarchive to the latest patched version. Until the update is applied, avoid processing tar archives from untrusted sources.
Other vulnerabilities in libarchive
See all- CVE-2017-13816High
An issue was discovered in certain Apple products, including macOS before 10.13.1, related to the 'libarchive' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted archive file.
- CVE-2017-13813High
An issue was discovered in certain Apple products, including macOS before 10.13.1, involving the 'libarchive' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted archive file.
- CVE-2017-13812High
An issue was discovered in certain Apple products, including macOS before 10.13.1, involving the 'libarchive' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted archive file.
- CVE-2017-14502High
The libarchive library version 3.3.2 has an off-by-one error in the read_header function affecting UTF-16 names in RAR archives. This can lead to an out-of-bounds read in the archive_read_format_rar_read_header function.
- CVE-2017-7068High
An issue was discovered in certain Apple products related to the 'libarchive' component. It affects iOS before 10.3.3, macOS before 10.12.6, tvOS before 10.2.2, and watchOS before 3.2.3, allowing remote attackers to execute arbitrary code or cause a denial of service.
- CVE-2016-8689High
The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.
- CVE-2016-8687High
A stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
- CVE-2017-5601High
An error in the lha_read_file_header_1() function in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access, potentially causing a crash via a specially crafted archive.
- CVE-2016-4736High
libarchive in Apple OS X before 10.12 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted file.
- CVE-2016-6250High
Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.
Original NVD description (English source)
A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS