Is CVE-2026-15028 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15028 being exploited in the wild.

How severe is CVE-2026-15028?

Low severity, with a CVSS score of 3.9, published 10 July 2026.

Which products and versions are affected?

Libarchive f0b9700384541c0f0f4abf6da8565d474ea7f783.

Is there a fix for CVE-2026-15028?

A patch was published on 2026-07-07: Fix merged into libarchive master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15028 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-15028?

Check whether you run Libarchive, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15028: libarchive heap overflow in PAX SUN.holesdata parsing

CVE-2026-15028 · Severity: low · CVSS 3.9 · Published 2026-07-10

A security flaw was identified in libarchive, a widely used library for reading and writing various archive formats like ZIP and TAR. By providing a specially crafted archive file, an attacker could cause the software to crash or potentially execute unauthorized commands. This could lead to a disruption of service or unauthorized access to systems that process untrusted archive files.

Technologies: Libarchive, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Libarchive, Red Hat.

Quick answers

Is CVE-2026-15028 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15028 being exploited in the wild.
How severe is CVE-2026-15028?: Low severity, with a CVSS score of 3.9, published 10 July 2026.
Which products and versions are affected?: Libarchive f0b9700384541c0f0f4abf6da8565d474ea7f783.
Is there a fix for CVE-2026-15028?: A patch was published on 2026-07-07: Fix merged into libarchive master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15028 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-15028?: Check whether you run Libarchive, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based out-of-bounds (OOB) read vulnerability exists in libarchive's TAR format support, specifically within the `pax_attribute_SUN_holesdata` function in `archive_read_support_format_tar.c`. The flaw is caused by `header_pax_extension()` passing an attribute value length to `pax_attribute()` that excludes the trailing newline, leading the parser to read one byte past the allocated buffer when `length == 0`. An attacker can exploit this by providing a specially crafted TAR archive with a malformed `SUN.holesdata` PAX extended header. While the reported CVSS reflects a low-impact local scenario, OOB reads in this component can lead to denial of service (crash) or potentially arbitrary code execution depending on the memory allocator's state. A fix has been merged into the libarchive master branch.

Affected products

libarchive libarchive f0b9700384541c0f0f4abf6da8565d474ea7f783
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat Hardened Images

Timeline

2026-07-06: disclosed: Issue reported on GitHub
2026-07-07: patched: Fix merged into libarchive master branch
2026-07-10: advisory: NVD and Red Hat published advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.