Quick answers
- Is CVE-2026-14164 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14164 being exploited in the wild.
- How severe is CVE-2026-14164?
- High severity, with a CVSS score of 7.5, published 30 June 2026.
- Which products and versions are affected?
- Libarchive All versions prior to the fix in master branch (May 2026).
- Is there a fix for CVE-2026-14164?
- A patch was published on 2026-05-24: Fix merged into libarchive master branch via Pull Request 3071 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-14164 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14164?
- Check whether you run Libarchive at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A double-free vulnerability exists in libarchive's RAR5 reader subsystem within `archive_read_support_format_rar5.c`. The issue is caused by a dangling pointer, `rar->cstate.filtered_buf`, which is not nullified after being released during unpacking state reinitialization (specifically in `init_unpack` if a memory allocation fails). An attacker can provide a crafted RAR5 archive that triggers a second free operation on the same memory address during subsequent processing. This results in a memory-manager abort and application crash. A fix has been merged into the libarchive master branch.
Affected products
- libarchive libarchive All versions prior to the fix in master branch (May 2026)
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Hardened Images
Timeline
- 2026-05-24: patched: Fix merged into libarchive master branch via Pull Request 3071
- 2026-06-26: disclosed: Reported to Red Hat Bugzilla
- 2026-06-30: advisory: CVE-2026-14164 published