Is CVE-2026-5121 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5121 being exploited in the wild.

How severe is CVE-2026-5121?

High severity, with a CVSS score of 7.5, published 30 March 2026.

Which products and versions are affected?

Libarchive All versions on 32-bit systems.

Is there a fix for CVE-2026-5121?

A patch was published on 2026-04-23: Red Hat released initial security updates (RHSA-2026:10065) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5121 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5121?

Check whether you run Libarchive at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5121: libarchive integer overflow in ISO9660 zisofs processing

CVE-2026-5121 · Severity: high · CVSS 7.5 · Published 2026-03-30

A security vulnerability has been identified in libarchive, a widely used software library for reading and writing various compressed file formats. On 32-bit systems, an attacker can use a specially crafted ISO image file to cause a system crash or potentially take control of the affected machine. This poses a risk to any application or service that automatically processes uploaded or external archive files.

Technologies: Libarchive. Vendors: Libarchive.

Quick answers

Is CVE-2026-5121 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5121 being exploited in the wild.
How severe is CVE-2026-5121?: High severity, with a CVSS score of 7.5, published 30 March 2026.
Which products and versions are affected?: Libarchive All versions on 32-bit systems.
Is there a fix for CVE-2026-5121?: A patch was published on 2026-04-23: Red Hat released initial security updates (RHSA-2026:10065) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5121 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5121?: Check whether you run Libarchive at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in libarchive's zisofs block pointer allocation logic, specifically affecting 32-bit architectures. The flaw is triggered when the library processes a malformed ISO9660 image, leading to an incorrect memory allocation size and a subsequent heap-based buffer overflow. A remote, unauthenticated attacker can exploit this by providing a crafted ISO image to an application using libarchive. Successful exploitation could result in a denial of service (crash) or arbitrary code execution. Red Hat has released several security advisories (e.g., RHSA-2026:10097) addressing this in their ecosystem, and a patch has been proposed in the upstream libarchive GitHub repository.

Affected products

libarchive libarchive All versions on 32-bit systems
Red Hat Enterprise Linux 9
Red Hat OpenShift Container Platform 4.16

Timeline

2026-03-30: disclosed: Initial publication date
2026-04-23: patched: Red Hat released initial security updates (RHSA-2026:10065)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.