EUVD-2026-42865
GHSA-p59g-85vj-3mvf
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
No privileges needed to process an archive; UI:R reflects required file-open interaction; C:H/I:H/A:H reflects the credible RCE claim from the vendor description, which the official low-impact metrics do not capture.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.
AnalysisAI
Heap overflow in libarchive's PAX extended header parser allows exploitation via a maliciously crafted tar archive containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation of the affected system could result in a denial of service condition or, in more serious cases, arbitrary code execution under the privileges of the process invoking libarchive. No public exploit code or active exploitation has been confirmed at time of analysis, though a GitHub pull request (#3253) indicating an upstream fix is available suggests the issue is reproducible and patch-ready. The official CVSS score of 3.9 (Low) conflicts materially with the vendor-applied RCE tag, a discrepancy that warrants independent validation.
Technical ContextAI
libarchive is a widely adopted open-source C library providing streaming archive read/write support for formats including tar, cpio, zip, and others. The vulnerability resides specifically in the parsing logic for PAX extended headers, a POSIX.1-2001 tar extension that supports arbitrary key-value metadata. The affected path processes the SUN.holesdata attribute, which encodes sparse-file hole data used by Solaris tar implementations. A malformed value in this attribute triggers a heap buffer overflow - a memory safety error where data written exceeds the bounds of the allocated heap region. This class of flaw (heap overflow) can result in heap metadata corruption, adjacent allocation corruption, or, under favorable heap layout conditions, controlled write primitives enabling code execution. No CWE was formally assigned in the NVD entry; the most applicable CWEs would be CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The issue was tracked at GitHub issue #3251 and remediated via pull request #3253.
Affected ProductsAI
The vulnerability affects the libarchive library, specifically its tar PAX extended header parsing component. Exact affected version ranges are not enumerated in the available NVD CPE data or referenced advisories; the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-15028 and associated Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2497970 should be consulted for Red Hat Enterprise Linux and derivative distribution specifics. Upstream tracking is at https://github.com/libarchive/libarchive/issues/3251. Any software that embeds or links against a vulnerable version of libarchive and processes untrusted tar archives with PAX extended headers is transitively affected, including distribution package managers, backup utilities, and archive extraction tooling.
RemediationAI
The primary fix is applying the upstream patch available via GitHub pull request #3253 (https://github.com/libarchive/libarchive/pull/3253); a formal tagged release version was not independently confirmed from the available data, so downstream consumers should monitor the libarchive release page and their distribution's security advisories for a packaged update. Red Hat subscribers should track https://access.redhat.com/security/cve/CVE-2026-15028 for RHEL-specific errata. Until a patch is applied, compensating controls include restricting the processing of externally sourced tar archives to isolated, sandboxed processes (e.g., via seccomp, namespaces, or dedicated low-privilege containers), which limits the blast radius of heap corruption to the sandboxed process rather than the host system. Disabling or filtering support for PAX extended header processing at the application layer is theoretically possible but would require application-level changes and may break legitimate sparse-file archive handling. Blocking untrusted archive input at ingestion boundaries (upload filters, content inspection) reduces attacker-controlled input reaching the vulnerable parser but does not eliminate risk from supply-chain or repository-sourced archives.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today