Junglewise Threat Intelligence

CVE-2026-5121: libarchive integer overflow in ISO9660 zisofs processing

CVE-2026-5121 · Severity: high · CVSS 7.5 · Published 2026-03-30

Technologies: Red Hat Enterprise Linux, Libarchive. Vendors: Red Hat, Libarchive.

Executive brief

A security vulnerability has been identified in libarchive, a widely used software library for reading and writing various compressed file formats. On 32-bit systems, an attacker can use a specially crafted ISO image file to cause a system crash or potentially take control of the affected machine. This poses a risk to any application or service that automatically processes uploaded or external archive files.

Technical details

An integer overflow vulnerability exists in libarchive's zisofs block pointer allocation logic, specifically affecting 32-bit architectures. The flaw is triggered when the library processes a malformed ISO9660 image, leading to an incorrect memory allocation size and a subsequent heap-based buffer overflow. A remote, unauthenticated attacker can exploit this by providing a crafted ISO image to an application using libarchive. Successful exploitation could result in a denial of service (crash) or arbitrary code execution. Red Hat has released several security advisories (e.g., RHSA-2026:10097) addressing this in their ecosystem, and a patch has been proposed in the upstream libarchive GitHub repository.

Affected products

  • libarchive libarchive All versions on 32-bit systems
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4.16

Timeline

  • 2026-03-30: disclosed: Initial publication date
  • 2026-04-23: patched: Red Hat released initial security updates (RHSA-2026:10065)

References

Related threats