EUVD-2026-103190
GHSA-x7v4-6qhp-jg74
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted archive to local libarchive app
-
ExploitUser opens/processes the input
-
ExecutionTrigger self-copy use-after-free in archive_entry_copy_mac_metadata()
-
ImpactCrash process or read uninitialized memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a local application built on libarchive to call archive_entry_copy_mac_metadata() with a source buffer that overlaps the entry's existing mac_metadata (a self-copy), since the original code frees entry->mac_metadata before the memcpy from that pointer. The attacker must be able to supply the input the application feeds to this function, and user interaction is required (UI:R) to make a local app process the malicious archive/metadata. Limiting factors: the vector is local (AV:L), the overlapping-buffer trigger makes it high-complexity (AC:H), impact is confined to a crash or disclosure of uninitialized memory (no code execution or integrity loss), and exploitation depends on the specific application's use of the Mac-metadata copy API rather than any default network-facing path. |
| Impact | This is a genuinely low-priority issue despite being a memory-corruption (use-after-free, CWE-416) flaw. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L, base 3.6) aligns well with the source evidence: the PR #3318 diff shows the bug is a self-copy use-after-free in archive_entry_copy_mac_metadata(), where entry->mac_metadata is freed before the memcpy, so it only misbehaves when the supplied source pointer overlaps the entry's own (already-freed) buffer. That is a narrow, application-dependent trigger, consistent with AC:H (high complexity) and AV:L (local - the attacker must get input into an application that calls this specific function). Impact is limited to a crash (A:L) or reading uninitialized/freed memory (C:L, info disclosure); there is no integrity impact (I:N) and no scope change (S:U). No EPSS score, no CISA KEV listing, and no public exploit were provided or found - the only GitHub artifact is the upstream fix plus a regression test, not a weaponized POC. The signals are consistent rather than conflicting: a low CVSS with no exploitation intelligence points to a real-but-minor defect, not an urgent threat. Note that affected-product data is vendor-centric (Red Hat CPEs/tags) while the actual vulnerable component is the independent upstream libarchive library - patch via the distro's updated libarchive package. |
| Exploit ScenarioDerived | A user is induced to process an attacker-influenced archive (or data stream) with a local application built on libarchive that invokes archive_entry_copy_mac_metadata() in a way that copies an entry's Mac metadata from a source pointer overlapping its own buffer. The freed-then-copied buffer causes a use-after-free, crashing the application (DoS) or exposing uninitialized memory contents. No public exploit code is known; the only related code is the upstream fix (libarchive PR #3318) and its regression test. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Use-after-free in libarchive's archive_entry_copy_mac_metadata() function allows an attacker who can influence the input an application feeds that API to crash the linked application or cause it to read uninitialized heap memory, yielding a CVSS 3.1 base score of 3.6 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L). The flaw is not remotely reachable by default and requires the consuming application to perform a self-copy in which the source buffer overlaps the entry's existing mac_metadata pointer; it is a genuinely low-priority memory-safety issue with impact limited to denial of service and minor information disclosure, with no integrity or code-execution outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Red Hat has published an upstream fix (libarchive PR #3318) alongside its advisory and Bugzilla tracking entry.
RemediationAI
The upstream fix is available as GitHub pull request 3318 (upstream fix available via PR/commit; a released, tagged patched version was not independently confirmed from the supplied data), so the primary action is to update libarchive to a build that contains that change and to rebuild or restart any dynamically linked consumers - note that because libarchive is a shared library, patching it is not sufficient until long-running processes that loaded the vulnerable object are restarted. On Red Hat platforms, track the erratum associated with the advisory https://access.redhat.com/security/cve/CVE-2026-17591 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2554209 and apply the vendor-supplied libarchive package update when it ships; Hardened Images and container base images must be rebuilt rather than patched in place. Until a patched package is deployed, the most targeted mitigation is to prevent the aliasing call pattern itself: audit application code that calls archive_entry_copy_mac_metadata() and guarantee the source pointer is never the entry's own mac_metadata buffer or a sub-range of it (copy into a separate staging buffer first), since this self-copy/overlap is the sole trigger, though the trade-off is added copy overhead and a code change in every affected consumer. A broader compensating control is to refuse or strip Mac metadata extended attributes when processing untrusted archives - for example, skip the mac_metadata assignment entirely in extraction tooling - which removes the attack surface but loses preservation of Apple-specific metadata on extraction and may break workflows that rely on it. Hardening the runtime (allocator randomization such as MALLOC_PERTURB_, ASLR, and reduced-privilege or sandboxed execution of archive-consuming processes) can make the uninitialized-memory disclosure less reliable and limits the blast radius of a crash, but these are defenses in depth and do not remediate the use-after-free; avoiding the overlapping-buffer call remains the only reliable pre-patch mitigation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libarchive is the portable C library used by tar, bsdtar, pkg managers, backup tools, and many language runtimes to parse and create streaming archives; the archive_entry abstraction holds the metadata for a single archive member. archive_entry_copy_mac_metadata() is the setter used to attach Apple/Mac OS X extended-attribute metadata to an entry. The vulnerable code path corresponds to CWE-416 (Use After Free): the original implementation freed entry->mac_metadata before allocating the replacement buffer and copying the caller-supplied bytes with memcpy(entry->mac_metadata, p, s). When the source pointer p aliases the entry's own mac_metadata buffer (for example a full or partial self-copy such as copy+1 with length copy_size-1), the memcpy reads from memory that has just been released, producing a crash or disclosure of whatever now occupies that freed heap block. The upstream patch restructures the routine to allocate a fresh buffer, memcpy from p into it, and only then free the old pointer and swap in the new one, eliminating the use-after-free regardless of aliasing; a regression test (test_entry_mac_metadata_self_copy) was added to exercise exact self-copy and offset sub-range self-copy cases. Exploitation prerequisites align with the assessed vector AV:L/AC:H/PR:N/UI:R: the attacker must be able to supply the data an application passes to this function, the trigger depends on an overlapping-buffer (self-copy) call that is unusual in normal code paths - hence high attack complexity - and user interaction is required to induce a local application to process the crafted archive or metadata.
Know when Libarchive gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
Local, application-dependent self-copy trigger justifies AV:L and AC:H; no auth needed (PR:N) but user must process input (UI:R); impact limited to crash and uninitialized-memory read (C:L/A:L, I:N).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Libarchive
View allCVE-2025-5914 is an integer overflow vulnerability in libarchive's archive_read_format_rar_seek_data() function that lea
Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enable
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mig
Stack-based buffer overflow in the parse_device function in archive_read_support_format_mtree.c in libarchive before 3.2
Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 a
Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 al
Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtr
Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pa
Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arb
Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (appl
Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive befo
Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init. Rated medium s
Exploit-DB