# CVE-2026-14164: libarchive double free in RAR5 reader

Source: https://junglewise.ai/threats/cve-2026-14164-libarchive-double-free-in-rar5-reader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-14164 · Severity: high · CVSS 7.5 · Published 2026-06-30

libarchive is a widely used software library for reading and writing various compressed file formats. A flaw in how it handles RAR5 archives allows an attacker to provide a specially crafted file that causes the application using libarchive to crash. This can lead to a denial-of-service, impacting the availability of services that automatically process or scan uploaded archive files.

Technologies: [Libarchive](https://junglewise.ai/threats/technologies/libarchive). Vendors: [Libarchive](https://junglewise.ai/threats/vendors/libarchive).

## Quick answers

**Is CVE-2026-14164 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14164 being exploited in the wild.

**How severe is CVE-2026-14164?** High severity, with a CVSS score of 7.5, published 30 June 2026.

**Which products and versions are affected?** Libarchive All versions prior to the fix in master branch (May 2026).

**Is there a fix for CVE-2026-14164?** A patch was published on 2026-05-24: Fix merged into libarchive master branch via Pull Request 3071 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14164 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14164?** Check whether you run Libarchive at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A double-free vulnerability exists in libarchive's RAR5 reader subsystem within `archive_read_support_format_rar5.c`. The issue is caused by a dangling pointer, `rar->cstate.filtered_buf`, which is not nullified after being released during unpacking state reinitialization (specifically in `init_unpack` if a memory allocation fails). An attacker can provide a crafted RAR5 archive that triggers a second free operation on the same memory address during subsequent processing. This results in a memory-manager abort and application crash. A fix has been merged into the libarchive master branch.

## Affected products

- libarchive libarchive All versions prior to the fix in master branch (May 2026)
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Hardened Images

## Timeline

- 2026-05-24: patched: Fix merged into libarchive master branch via Pull Request 3071
- 2026-06-26: disclosed: Reported to Red Hat Bugzilla
- 2026-06-30: advisory: CVE-2026-14164 published

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-14164](https://access.redhat.com/security/cve/CVE-2026-14164)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2493411](https://bugzilla.redhat.com/show_bug.cgi?id=2493411)
- [https://github.com/libarchive/libarchive/issues/3069](https://github.com/libarchive/libarchive/issues/3069)
- [https://github.com/libarchive/libarchive/pull/3071](https://github.com/libarchive/libarchive/pull/3071)

## Related threats

- [Windows Libarchive double free vulnerability](https://junglewise.ai/threats/cve-2026-70062-double-free-in-windows-libarchive-allows-an-unauthorized-attacker)
- [Windows Libarchive path traversal vulnerability](https://junglewise.ai/threats/cve-2026-69973-improper-limitation-of-a-pathname-to-a-restricted-directory-path)
- [Libarchive relative path traversal in Windows](https://junglewise.ai/threats/cve-2026-69968-relative-path-traversal-in-windows-libarchive-allows-an)
- [libarchive gzip writer heap buffer overflow in original-filename](https://junglewise.ai/threats/cve-2025-64031-libarchive-gzip-writer-heap-buffer-overflow-in-original-filename)
- [libarchive heap overflow in PAX SUN.holesdata parsing](https://junglewise.ai/threats/cve-2026-15028-libarchive-heap-overflow-in-pax-sun-holesdata-parsing)