# CVE-2026-5121: libarchive integer overflow in ISO9660 zisofs processing

Source: https://junglewise.ai/threats/cve-2026-5121-libarchive-integer-overflow-in-iso9660-zisofs-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-30. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-5121 · Severity: high · CVSS 7.5 · Published 2026-03-30

A security vulnerability has been identified in libarchive, a widely used software library for reading and writing various compressed file formats. On 32-bit systems, an attacker can use a specially crafted ISO image file to cause a system crash or potentially take control of the affected machine. This poses a risk to any application or service that automatically processes uploaded or external archive files.

Technologies: [Libarchive](https://junglewise.ai/threats/technologies/libarchive). Vendors: [Libarchive](https://junglewise.ai/threats/vendors/libarchive).

## Quick answers

**Is CVE-2026-5121 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5121 being exploited in the wild.

**How severe is CVE-2026-5121?** High severity, with a CVSS score of 7.5, published 30 March 2026.

**Which products and versions are affected?** Libarchive All versions on 32-bit systems.

**Is there a fix for CVE-2026-5121?** A patch was published on 2026-04-23: Red Hat released initial security updates (RHSA-2026:10065) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5121 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5121?** Check whether you run Libarchive at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in libarchive's zisofs block pointer allocation logic, specifically affecting 32-bit architectures. The flaw is triggered when the library processes a malformed ISO9660 image, leading to an incorrect memory allocation size and a subsequent heap-based buffer overflow. A remote, unauthenticated attacker can exploit this by providing a crafted ISO image to an application using libarchive. Successful exploitation could result in a denial of service (crash) or arbitrary code execution. Red Hat has released several security advisories (e.g., RHSA-2026:10097) addressing this in their ecosystem, and a patch has been proposed in the upstream libarchive GitHub repository.

## Affected products

- libarchive libarchive All versions on 32-bit systems
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4.16

## Timeline

- 2026-03-30: disclosed: Initial publication date
- 2026-04-23: patched: Red Hat released initial security updates (RHSA-2026:10065)

## References

- [https://access.redhat.com/errata/RHSA-2026:10065](https://access.redhat.com/errata/RHSA-2026:10065)
- [https://access.redhat.com/errata/RHSA-2026:10097](https://access.redhat.com/errata/RHSA-2026:10097)
- [https://access.redhat.com/errata/RHSA-2026:11768](https://access.redhat.com/errata/RHSA-2026:11768)
- [https://access.redhat.com/errata/RHSA-2026:12071](https://access.redhat.com/errata/RHSA-2026:12071)
- [https://access.redhat.com/errata/RHSA-2026:12274](https://access.redhat.com/errata/RHSA-2026:12274)
- [https://access.redhat.com/errata/RHSA-2026:13812](https://access.redhat.com/errata/RHSA-2026:13812)
- [https://access.redhat.com/errata/RHSA-2026:14773](https://access.redhat.com/errata/RHSA-2026:14773)

## Related threats

- [Windows Libarchive double free vulnerability](https://junglewise.ai/threats/cve-2026-70062-double-free-in-windows-libarchive-allows-an-unauthorized-attacker)
- [Windows Libarchive path traversal vulnerability](https://junglewise.ai/threats/cve-2026-69973-improper-limitation-of-a-pathname-to-a-restricted-directory-path)
- [Libarchive relative path traversal in Windows](https://junglewise.ai/threats/cve-2026-69968-relative-path-traversal-in-windows-libarchive-allows-an)
- [libarchive gzip writer heap buffer overflow in original-filename](https://junglewise.ai/threats/cve-2025-64031-libarchive-gzip-writer-heap-buffer-overflow-in-original-filename)
- [libarchive heap overflow in PAX SUN.holesdata parsing](https://junglewise.ai/threats/cve-2026-15028-libarchive-heap-overflow-in-pax-sun-holesdata-parsing)