# Libarchive vulnerabilities Source: https://junglewise.ai/threats/technologies/libarchive Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/libarchive.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 16 vulnerabilities in Libarchive: 0 in the last 7 days and 6 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-70062, was published on 13 October 2026. 5 vulnerabilities in the last four weeks, up 400% on the four before (1). 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 6 - All time: 16 (1 critical, 0 exploited in the wild) ## About Libarchive C library for reading and writing archive formats including tar, cpio, and ZIP. ## Latest Libarchive vulnerabilities - [CVE-2026-70062: Windows Libarchive double free vulnerability](https://junglewise.ai/threats/cve-2026-70062-double-free-in-windows-libarchive-allows-an-unauthorized-attacker) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-69985: libarchive heap-based buffer overflow in Windows](https://junglewise.ai/threats/cve-2026-69985-heap-based-buffer-overflow-in-windows-libarchive-allows-an) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-69973: Windows Libarchive path traversal vulnerability](https://junglewise.ai/threats/cve-2026-69973-improper-limitation-of-a-pathname-to-a-restricted-directory-path) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-69968: Libarchive relative path traversal in Windows](https://junglewise.ai/threats/cve-2026-69968-relative-path-traversal-in-windows-libarchive-allows-an) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-69639: Windows Libarchive heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-69639-heap-based-buffer-overflow-in-windows-libarchive-allows-an) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2025-64031: libarchive gzip writer heap buffer overflow in original-filename](https://junglewise.ai/threats/cve-2025-64031-libarchive-gzip-writer-heap-buffer-overflow-in-original-filename) (low, CVSS 2.5, published 14 Sep 2026) - [CVE-2026-16517: libarchive signed integer overflow in ZIP writer](https://junglewise.ai/threats/cve-2026-16517-libarchive-signed-integer-overflow-in-zip-writer) (low, CVSS 2.9, published 21 Jul 2026) - [CVE-2026-15028: libarchive heap overflow in PAX SUN.holesdata parsing](https://junglewise.ai/threats/cve-2026-15028-libarchive-heap-overflow-in-pax-sun-holesdata-parsing) (low, CVSS 3.9, published 10 Jul 2026) - [CVE-2026-14164: libarchive double free in RAR5 reader](https://junglewise.ai/threats/cve-2026-14164-libarchive-double-free-in-rar5-reader) (high, CVSS 7.5, published 30 Jun 2026) - [CVE-2026-5745: A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically…](https://junglewise.ai/threats/cve-2026-5745-a-flaw-was-found-in-libarchive-a-null-pointer-dereference) (medium, CVSS 5.5, published 7 Apr 2026) - [CVE-2026-5121: libarchive integer overflow in ISO9660 zisofs processing](https://junglewise.ai/threats/cve-2026-5121-libarchive-integer-overflow-in-iso9660-zisofs-processing) (high, CVSS 7.5, published 30 Mar 2026) - [CVE-2026-4426: libarchive undefined behavior in zisofs decompression](https://junglewise.ai/threats/cve-2026-4426-libarchive-undefined-behavior-in-zisofs-decompression) (medium, CVSS 6.5, published 19 Mar 2026) - [CVE-2026-4424: libarchive heap out-of-bounds read in RAR processing](https://junglewise.ai/threats/cve-2026-4424-libarchive-heap-out-of-bounds-read-in-rar-processing) (high, CVSS 7.5, published 19 Mar 2026) - [CVE-2026-4111: libarchive infinite loop in RAR5 decompression](https://junglewise.ai/threats/cve-2026-4111-libarchive-infinite-loop-in-rar5-decompression) (high, CVSS 7.5, published 13 Mar 2026) - [CVE-2025-60753: An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c…](https://junglewise.ai/threats/cve-2025-60753-an-issue-was-discovered-in-libarchive-bsdtar-before-version-3-8-1) (medium, CVSS 5.5, published 5 Nov 2025) - [CVE-2017-5601: libarchive out-of-bounds read in lha_read_file_header_1](https://junglewise.ai/threats/cve-2017-5601-libarchive-out-of-bounds-read-in-lha-read-file-header-1) (high, CVSS 7.5, published 27 Jan 2017) ## Most severe Libarchive vulnerabilities - [CVE-2026-69639: Windows Libarchive heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-69639-heap-based-buffer-overflow-in-windows-libarchive-allows-an) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2026-69985: libarchive heap-based buffer overflow in Windows](https://junglewise.ai/threats/cve-2026-69985-heap-based-buffer-overflow-in-windows-libarchive-allows-an) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-70062: Windows Libarchive double free vulnerability](https://junglewise.ai/threats/cve-2026-70062-double-free-in-windows-libarchive-allows-an-unauthorized-attacker) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-4424: libarchive heap out-of-bounds read in RAR processing](https://junglewise.ai/threats/cve-2026-4424-libarchive-heap-out-of-bounds-read-in-rar-processing) (high, CVSS 7.5, published 19 Mar 2026) - [CVE-2026-5121: libarchive integer overflow in ISO9660 zisofs processing](https://junglewise.ai/threats/cve-2026-5121-libarchive-integer-overflow-in-iso9660-zisofs-processing) (high, CVSS 7.5, published 30 Mar 2026) - [CVE-2026-4111: libarchive infinite loop in RAR5 decompression](https://junglewise.ai/threats/cve-2026-4111-libarchive-infinite-loop-in-rar5-decompression) (high, CVSS 7.5, published 13 Mar 2026) - [CVE-2026-14164: libarchive double free in RAR5 reader](https://junglewise.ai/threats/cve-2026-14164-libarchive-double-free-in-rar5-reader) (high, CVSS 7.5, published 30 Jun 2026) - [CVE-2017-5601: libarchive out-of-bounds read in lha_read_file_header_1](https://junglewise.ai/threats/cve-2017-5601-libarchive-out-of-bounds-read-in-lha-read-file-header-1) (high, CVSS 7.5, published 27 Jan 2017) - [CVE-2026-69968: Libarchive relative path traversal in Windows](https://junglewise.ai/threats/cve-2026-69968-relative-path-traversal-in-windows-libarchive-allows-an) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-69973: Windows Libarchive path traversal vulnerability](https://junglewise.ai/threats/cve-2026-69973-improper-limitation-of-a-pathname-to-a-restricted-directory-path) (medium, CVSS 6.5, published 13 Oct 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, up 400% on the four before (1). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 5 | 1 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Libarchive vulnerabilities", https://junglewise.ai/threats/technologies/libarchive, 13 November 2026.