Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Submit crafted multi-entry RAR5 archive
  2. Delivery
    libarchive RAR5 reader reinitializes unpack state, frees filtered_buf
  3. Exploit
    Stale pointer survives into next entry
  4. Execution
    Second free triggers double-free
  5. Persist
    Heap corruption aborts process
  6. Impact
    Application denial of service

Vulnerability Assessment

Weakness
CWE
CWE-415
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
Exploitation Conditions

Exploitation requires that the target application use libarchive's RAR5 reader to parse an attacker-supplied, specially crafted RAR5 archive in which the unpacking state is reinitialized (freeing filtered_buf) and then a subsequent archive entry is processed, triggering the second free - so a multi-entry malicious RAR5 archive is the concrete prerequisite. The CVSS vector lists PR:N/UI:N (unauthenticated, no user interaction), but in practice the limiting factor is delivery: the victim must actually decompress the malicious archive, so only deployments that accept and parse untrusted RAR5 input are exposed, and applications that disable RAR support or never process untrusted archives are not reachable. Impact is bounded to a crash (A:H, no C/I), so there is no privilege gain or data exposure to chain from this condition.
Impact

The signals are internally consistent and point to a moderate, availability-only risk rather than a critical one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 because the only impact is denial of service - there is no confidentiality or integrity loss and the description explicitly limits the outcome to unexpected termination. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; treat the network-vector/no-privileges framing cautiously, since real-world triggering still requires getting a malicious RAR5 archive into a service that parses it. Heap double-frees are in principle a stronger primitive than a plain crash, but neither the CVE nor Red Hat claims memory-corruption-to-RCE, so this should be prioritized as a routine DoS patch - higher urgency only for internet-facing services that automatically decompress user-supplied RAR archives.
Exploit ScenarioDerived

An attacker crafts a malicious RAR5 archive whose entries force the RAR5 unpacker through a state reinitialization that leaves filtered_buf stale, then arranges for a victim application - for example an email/antivirus gateway, file-sharing backend, or backup tool that auto-extracts uploads - to parse it. Processing a later entry triggers the second free of the same buffer, corrupting the heap and aborting the process, causing denial of service. No public POC is referenced, and the network attack vector with low complexity means the main barrier is simply getting the archive into a parsing pipeline.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 30, 2026

Denial of service in libarchive's RAR5 reader allows remote attackers to crash applications that decompress untrusted RAR5 archives via a double-free (CWE-415) of the stale filtered_buf pointer. Reported by Red Hat and affecting libarchive as shipped across Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images, the flaw is triggered purely by parsing a malicious archive entry. No public exploit has been identified and the issue is not in CISA KEV; impact is limited to availability (CVSS 7.5, A:H only) with no code execution or data exposure claimed.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the libarchive correction from pull request https://github.com/libarchive/libarchive/pull/3071 once it lands in a tagged release, and for Red Hat systems install the updated libarchive package when published per the advisory at https://access.redhat.com/security/cve/CVE-2026-14164 (track via Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2493411). Until a packaged build is available, the practical compensating control is to avoid feeding untrusted RAR5 archives to libarchive: disable or block RAR handling in any service that automatically decompresses user-supplied archives, or gate such processing behind format allow-lists and sandbox the parser (separate process, resource limits, automatic restart) so a crash does not take down the host service - the trade-off is loss of RAR support and added operational complexity. Restrict and rate-limit the upload/ingest paths that reach the archive parser to reduce exposure to anonymous submitters.

Affected VersionsENISA

Red Hat Hardened Images patch: 3.8.8-2.hum1

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libarchive is a widely embedded C library (the engine behind bsdtar/bsdcpio and countless backup, packaging, container, and file-management tools) that provides streaming read/write access to many archive formats, including RAR5. The defect is in the RAR5 unpacking code path: during reinitialization of the unpacking state, the filtered_buf buffer is freed but its pointer is left dangling (stale) rather than nulled. When a subsequent archive entry is processed, the same memory region is freed a second time, producing a classic CWE-415 double-free. Double-frees corrupt the heap allocator's internal bookkeeping, which in glibc typically aborts the process; the upstream discussion is tracked in libarchive issue #3069 with the fix in pull request #3071.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Triggered by parsing attacker-supplied archive data without privileges or interaction (AV:N/AC:L/PR:N/UI:N); impact is limited to a process crash so only A:H, with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Red Hat 7.5 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

Executive ViewAI

Why It Matters

A denial-of-service vulnerability in libarchive's RAR5 reader (CVE-2026-14164, CVSS 7.5) affects Red Hat Enterprise Linux 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images, enabling remote attackers to crash applications that process untrusted RAR5 archives. No public exploit identified at time of analysis, and risk is limited to availability disruption rather than data compromise or code execution; however, unauthenticated triggering via malicious archive files presents risk wherever untrusted archives are processed.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable RAR5 reader in libarchive if not operationally required; (2) Restrict archive decompression to pre-validated, trusted sources only; (3) Enforce strict resource limits and timeouts on archive processing; (4) Scan/validate archives before decompression using defense-in-depth strategies; (5) Isolate archive-processing workloads in resource-constrained containers; (6) Monitor Red Hat Security Advisories for CVE-2026-14164 patch availability.

Threat Intelligence Overview

EPSS Score
0.4%
Top 73% exploitable
Prevalence
High
core archive library embedded across Linux distros, tools, and containers
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-14164 ADVISORY https://ubuntu.com/security/notices/USN-8581-1 ADVISORY https://vuldb.com/vuln/374795 REF https://access.redhat.com/errata/RHSA-2026:30333 REF https://access.redhat.com/errata/RHSA-2026:52674 REF https://access.redhat.com/errata/RHSA-2026:52675 REF https://access.redhat.com/errata/RHSA-2026:54387 REF https://access.redhat.com/errata/RHSA-2026:54760 REF https://access.redhat.com/errata/RHSA-2026:54769 REF https://access.redhat.com/errata/RHSA-2026:56954 REF https://access.redhat.com/errata/RHSA-2026:58558 REF https://access.redhat.com/errata/RHSA-2026:58573 REF https://access.redhat.com/errata/RHSA-2026:58574 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:61783 REF https://access.redhat.com/errata/RHSA-2026:62409 REF https://access.redhat.com/errata/RHSA-2026:63041 REF https://access.redhat.com/errata/RHSA-2026:63044 REF https://access.redhat.com/errata/RHSA-2026:63100 REF https://access.redhat.com/errata/RHSA-2026:65839 REF https://access.redhat.com/errata/RHSA-2026:65851 REF https://access.redhat.com/errata/RHSA-2026:67857 REF https://access.redhat.com/errata/RHSA-2026:67935 REF https://access.redhat.com/errata/RHSA-2026:70586 REF https://access.redhat.com/errata/RHSA-2026:70615 REF https://access.redhat.com/errata/RHSA-2026:72394 REF https://access.redhat.com/errata/RHSA-2026:72395 REF https://access.redhat.com/errata/RHSA-2026:72399 REF https://access.redhat.com/errata/RHSA-2026:72470 REF https://access.redhat.com/errata/RHSA-2026:72475 REF https://access.redhat.com/errata/RHSA-2026:72476 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:73909 REF https://access.redhat.com/errata/RHSA-2026:73959 REF https://access.redhat.com/errata/RHSA-2026:73960 REF https://access.redhat.com/errata/RHSA-2026:73961 REF https://access.redhat.com/errata/RHSA-2026:73962 REF https://access.redhat.com/errata/RHSA-2026:74458 REF https://access.redhat.com/errata/RHSA-2026:74459 REF https://access.redhat.com/errata/RHSA-2026:74460 REF https://access.redhat.com/errata/RHSA-2026:74461 REF https://access.redhat.com/errata/RHSA-2026:74462 REF https://access.redhat.com/errata/RHSA-2026:74463 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:82061 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82336 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82371 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/security/cve/CVE-2026-14164 REF https://bugzilla.redhat.com/show_bug.cgi?id=2493411 REF https://github.com/libarchive/libarchive/issues/3069 REF https://github.com/libarchive/libarchive/pull/3071

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy