Executive brief
A security flaw was identified in libarchive, a widely used library for reading and writing various archive formats like ZIP and TAR. By providing a specially crafted archive file, an attacker could cause the software to crash or potentially execute unauthorized commands. This could lead to a disruption of service or unauthorized access to systems that process untrusted archive files.
Technical details
A heap-based out-of-bounds (OOB) read vulnerability exists in libarchive's TAR format support, specifically within the `pax_attribute_SUN_holesdata` function in `archive_read_support_format_tar.c`. The flaw is caused by `header_pax_extension()` passing an attribute value length to `pax_attribute()` that excludes the trailing newline, leading the parser to read one byte past the allocated buffer when `length == 0`. An attacker can exploit this by providing a specially crafted TAR archive with a malformed `SUN.holesdata` PAX extended header. While the reported CVSS reflects a low-impact local scenario, OOB reads in this component can lead to denial of service (crash) or potentially arbitrary code execution depending on the memory allocator's state. A fix has been merged into the libarchive master branch.
Affected products
- libarchive libarchive f0b9700384541c0f0f4abf6da8565d474ea7f783
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Hardened Images
Timeline
- 2026-07-06: disclosed: Issue reported on GitHub
- 2026-07-07: patched: Fix merged into libarchive master branch
- 2026-07-10: advisory: NVD and Red Hat published advisory details