Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious ISO9660 with zisofs overflow
  2. Delivery
    Deliver via network (HTTP/email/repository)
  3. Exploit
    Victim system processes ISO with libarchive
  4. Execution
    Trigger integer overflow in block pointer allocation
  5. Persist
    Overflow heap buffer during decompression
  6. Impact
    Execute arbitrary code with process privileges

Vulnerability Assessment

Weakness
CWE
CWE-190
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target system to be running a 32-bit architecture build of libarchive, as the integer overflow specifically affects 32-bit pointer arithmetic and does not manifest on 64-bit systems. The attacker must successfully deliver a maliciously crafted ISO9660 image containing zisofs-compressed data to a system or application that processes it using the vulnerable libarchive library. No user interaction is required per the CVSS vector (UI:N), meaning automated archive processing workflows such as package repository synchronization, container image analysis, or backup restoration can trigger exploitation without human involvement. No authentication is required to deliver the malicious file (PR:N), and attack complexity is low (AC:L), indicating reliable exploitation once the crafted ISO reaches vulnerable 32-bit systems. The primary limiting factor for real-world exploitation is the declining prevalence of 32-bit Linux deployments in production environments, particularly in enterprise and cloud infrastructure where 64-bit architectures dominate.
Impact

The CVSS vector indicates network-accessible exploitation requiring no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), suggesting high theoretical accessibility. However, critical discrepancies exist between vulnerability characteristics and risk signals. The CVSS confidentiality impact is marked High with no integrity or availability impact (C:H/I:N/A:N), yet the description explicitly states potential arbitrary code execution, which inherently provides total system impact across all CIA triad dimensions. This CVSS vector appears inconsistent with the described RCE capability. The SSVC framework more accurately reflects reality by classifying technical impact as 'total' and marking the vulnerability as automatable. Despite these severe characteristics, the EPSS score of 0.05% (16th percentile) indicates extremely low observed exploitation probability in the wild. No CISA KEV listing exists, and SSVC exploitation status is 'none', confirming no active exploitation detected. The primary limiting factor is the 32-bit architecture requirement, which significantly reduces the attack surface in modern predominantly 64-bit environments. Real-world risk is moderate: while the vulnerability is technically severe and affects critical infrastructure components, exploitation requires targeting increasingly rare 32-bit deployments, and no weaponized exploits have emerged despite patch availability and public disclosure.
Exploit ScenarioDerived

An attacker hosts a malicious ISO9660 image file on a web server or embeds it in email attachments, crafted to trigger integer overflow in zisofs block pointer calculations when processed by 32-bit libarchive implementations. When a victim system or automated service (package repository mirror, backup system, container image scanner) downloads and extracts the malicious ISO, the overflow causes undersized heap allocation followed by buffer overflow during decompression. The attacker leverages this memory corruption to inject and execute arbitrary code with the privileges of the process handling the archive, potentially gaining initial access to enterprise Linux servers or container orchestration infrastructure.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv8 – Apr 22, 2026

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via specially crafted ISO9660 images. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and OpenShift Container Platform 4, with vendor patches released across multiple RHSA advisories. Despite the CVSS 7.5 score and network attack vector, EPSS exploitation probability is low (0.05%, 16th percentile) and no public exploit is identified at time of analysis, though SSVC classifies the vulnerability as automatable with total technical impact.

Earlier versions of this analysis (7)
v7 Apr 20, 2026 - 14:27 cvss changed CVSS 7.5

Integer overflow in libarchive's zisofs block pointer allocation on 32-bit systems enables remote code execution via malicious ISO9660 images. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. Vendor patches available (RHSA-2026:8510 series). CVSS 7.5 indicates network-exploitable with no authentication, but EPSS score is notably low at 0.05% (16th percentile), suggesting minimal observed exploitation attempts despite RCE capability. No active exploitation confirmed (not in CISA KEV). Public exploit code exists per GitHub PR #2934.

v6 Apr 20, 2026 - 09:44 cvss changed CVSS 7.5

Integer overflow in libarchive's zisofs block pointer allocation on 32-bit systems allows remote unauthenticated attackers to trigger heap buffer overflow via malicious ISO9660 images, potentially enabling arbitrary code execution. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. Vendor patches available (multiple RHSA advisories released). No active exploitation confirmed (EPSS 0.05%, not in CISA KEV). Upstream fix merged via GitHub PR #2934. CRITICAL DISCREPANCY: CVSS vector shows C:H/I:N/A:N (confidentiality impact only) but description explicitly states arbitrary code execution capability (which requires integrity impact). This suggests either CVSS scoring error or incomplete vendor analysis - actual impact likely higher than vector indicates.

v5 Apr 20, 2026 - 06:27 cvss changed CVSS 7.5

Remote code execution in libarchive on 32-bit systems allows unauthenticated network attackers to execute arbitrary code via malicious ISO9660 images. The vulnerability affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches now available across multiple RHEL versions (RHSA-2026:8510, 8517, 8521, 8534, 8864, 8867, 8873, 8908). Despite CVSS 7.5 severity and the RCE potential, EPSS exploitation probability is very low (0.05%, 16th percentile) with no public exploit code or CISA KEV listing, suggesting theoretical rather than actively exploited risk. The narrow attack surface (32-bit systems only, ISO9660 processing required) limits real-world exposure compared to the network-accessible CVSS vector.

v4 Apr 20, 2026 - 05:27 cvss changed CVSS 7.5

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via malicious ISO9660 images. The vulnerability affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 through an integer overflow in zisofs block pointer allocation that triggers heap buffer overflow. Vendor patches available from Red Hat (RHSA-2026:8510, 8534, 8517, 8521, 8867, 8864, 8873) and upstream fix in GitHub PR #2934. Low EPSS score (0.05%, 16th percentile) suggests limited exploitation activity despite network-accessible attack vector and no authentication requirement.

v3 Apr 20, 2026 - 04:31 cvss changed CVSS 7.5

Integer overflow in libarchive's zisofs block pointer allocation on 32-bit systems allows remote unauthenticated attackers to trigger heap buffer overflows and potentially execute arbitrary code by serving malicious ISO9660 images. Red Hat has released patches (RHSA-2026:8510, 8517, 8521, 8534, 8864, 8867) across RHEL 6-10 and OpenShift Container Platform 4. Despite CVSS 7.5 (High), EPSS score is only 0.05% (16th percentile), indicating low probability of widespread exploitation. No active exploitation confirmed (not in CISA KEV), but upstream fix exists via GitHub PR #2934. Primary risk to 32-bit systems processing untrusted ISO files.

v2 Apr 20, 2026 - 03:27 cvss changed CVSS 7.5

Integer overflow in libarchive's zisofs block pointer allocation (affecting 32-bit systems only) enables remote code execution via malicious ISO9660 images. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. Vendor-released patches available (RHSA-2026:8510, 8517, 8521, 8534, 8867). No active exploitation confirmed (EPSS 0.05%, not in CISA KEV). CRITICAL CAVEAT: CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates confidentiality-only impact with no integrity or availability impact, directly contradicting the description's claim of heap buffer overflow and arbitrary code execution, which would require C:H/I:H/A:H. This discrepancy suggests either misconfigured CVSS scoring or the vulnerability's actual exploitability is significantly limited - real-world impact assessment requires vendor clarification.

v1 Mar 30, 2026 - 08:15 CVSS 7.5

Integer overflow in libarchive's zisofs block pointer allocation on 32-bit systems allows remote code execution when processing specially crafted ISO9660 images. A remote attacker can provide a malicious ISO file that triggers a heap buffer overflow, potentially achieving arbitrary code execution on affected systems. Red Hat Enterprise Linux versions 6-10 and Red Hat OpenShift Container Platform 4 are affected; no public exploit identified at time of analysis, though an upstream fix is available via GitHub PR.

RemediationAI

Apply vendor-released patches immediately for affected Red Hat Enterprise Linux and OpenShift Container Platform deployments by installing updated libarchive packages through the referenced RHSA advisories (RHSA-2026:8510, 8534, 8517, 8521, 8867, 8864, 8873, 8908, 8866) available at https://access.redhat.com/errata/. Upstream fix available via GitHub pull request #2934 at https://github.com/libarchive/libarchive/pull/2934, though released patched version numbers are not independently confirmed from available data. For systems that cannot be immediately patched, implement defense-in-depth controls: restrict processing of untrusted ISO9660 images to isolated sandbox environments with limited privileges, disable automatic mounting or extraction of ISO images from untrusted sources, and implement file type validation before passing archives to libarchive. Note that blocking ISO9660 format entirely may break legitimate workflows involving CD/DVD images or software distribution. On systems with both 32-bit and 64-bit architecture support, prioritize migration to 64-bit builds where feasible, as the vulnerability specifically affects 32-bit systems. Monitor Red Hat security advisories and Debian security tracker for distribution-specific patch releases if using Debian-based systems.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects libarchive, a widely-used multi-format archive and compression library. The flaw resides in the zisofs (compressed ISO9660 filesystem) block pointer allocation logic, specifically impacting 32-bit system architectures. CWE-190 integer overflow occurs when processing zisofs block pointers in maliciously crafted ISO9660 images, causing an undersized heap allocation. Subsequent writes overflow this buffer, enabling memory corruption and potential code execution. The vulnerability is particularly relevant for systems using libarchive to process untrusted archive files, including package managers, backup tools, and file extraction utilities. Red Hat's CPE data indicates widespread exposure across RHEL 6-10 and containerized environments running OpenShift Container Platform 4, where libarchive is a core dependency for RPM package management and container image handling.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CIRCL (temporal) 9.8 CRITICAL
SUSE 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

11
Analysis Updated
Apr 22, 2026 - 07:27 vuln.today
v8 - CVSS changed
Analysis Updated
Apr 20, 2026 - 14:27 vuln.today
v7 - CVSS changed
Analysis Updated
Apr 20, 2026 - 09:44 vuln.today
v6 - CVSS changed
Analysis Updated
Apr 20, 2026 - 06:27 vuln.today
v5 - CVSS changed
Analysis Updated
Apr 20, 2026 - 05:27 vuln.today
v4 - CVSS changed
Analysis Updated
Apr 20, 2026 - 04:31 vuln.today
v3 - CVSS changed
Analysis Updated
Apr 20, 2026 - 03:27 vuln.today
v2 - CVSS changed
Severity Changed
Apr 14, 2026 - 16:22 NVD
CRITICAL HIGH
CVSS changed
Apr 14, 2026 - 16:22 NVD
9.8 (CRITICAL) 7.5 (HIGH)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 30, 2026 - 07:47 nvd
CRITICAL 9.8

DescriptionCVE.org

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

Executive ViewAI

Why It Matters

CVE-2026-5121 is a remote code execution vulnerability in libarchive affecting Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, allowing unauthenticated attackers to execute arbitrary code through malicious ISO9660 images. While the technical severity is high (CVSS 7.5), real-world exploitation probability remains low (0.1% EPSS), but the vulnerability's automatable nature and presence in containerized environments warrant prompt patching to prevent supply-chain attack vectors.

Business Impact: High
Compensating Controls

Apply vendor patch. Interim mitigations pending patch deployment: (1) Restrict ISO9660 image processing to internal, trusted sources only; (2) Disable libarchive-based archive handling in public-facing services if operationally feasible; (3) Implement strict input validation and file type restrictions on upload endpoints; (4) Run vulnerable services in restricted containers with minimal privileges and network segmentation.

Threat Intelligence Overview

EPSS Score
0.1%
Top 84% exploitable
Threat Intel
1
1 source
Data Quality
9 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment CISA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Total

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-107935 CRITICAL
9.3 Oct 09

Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

Debian

libarchive
Release Status Fixed Version Urgency
bullseye vulnerable 3.4.3-2+deb11u1 -
bullseye (security) vulnerable 3.4.3-2+deb11u3 -
bookworm vulnerable 3.6.2-1+deb12u3 -
bookworm (security) vulnerable 3.6.2-1+deb12u2 -
trixie vulnerable 3.7.4-4 -
forky, sid vulnerable 3.8.5-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: Critical
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-202-04
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-5121 ADVISORY https://ubuntu.com/security/notices/USN-8292-1 ADVISORY https://vuldb.com/vuln/354160 REF https://access.redhat.com/errata/RHSA-2026:10065 REF https://access.redhat.com/errata/RHSA-2026:10097 REF https://access.redhat.com/errata/RHSA-2026:11768 REF https://access.redhat.com/errata/RHSA-2026:12071 REF https://access.redhat.com/errata/RHSA-2026:12274 REF https://access.redhat.com/errata/RHSA-2026:13812 REF https://access.redhat.com/errata/RHSA-2026:14773 REF https://access.redhat.com/errata/RHSA-2026:14937 REF https://access.redhat.com/errata/RHSA-2026:15087 REF https://access.redhat.com/errata/RHSA-2026:16008 REF https://access.redhat.com/errata/RHSA-2026:16009 REF https://access.redhat.com/errata/RHSA-2026:16030 REF https://access.redhat.com/errata/RHSA-2026:16174 REF https://access.redhat.com/errata/RHSA-2026:17596 REF https://access.redhat.com/errata/RHSA-2026:19724 REF https://access.redhat.com/errata/RHSA-2026:19725 REF https://access.redhat.com/errata/RHSA-2026:20040 REF https://access.redhat.com/errata/RHSA-2026:21690 REF https://access.redhat.com/errata/RHSA-2026:25096 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/errata/RHSA-2026:8510 REF https://access.redhat.com/errata/RHSA-2026:8517 REF https://access.redhat.com/errata/RHSA-2026:8521 REF https://access.redhat.com/errata/RHSA-2026:8534 REF https://access.redhat.com/errata/RHSA-2026:8864 REF https://access.redhat.com/errata/RHSA-2026:8866 REF https://access.redhat.com/errata/RHSA-2026:8867 REF https://access.redhat.com/errata/RHSA-2026:8873 REF https://access.redhat.com/errata/RHSA-2026:8908 REF https://access.redhat.com/errata/RHSA-2026:8944 REF https://access.redhat.com/errata/RHSA-2026:9026 REF https://access.redhat.com/errata/RHSA-2026:9592 REF https://access.redhat.com/errata/RHSA-2026:9832 REF https://access.redhat.com/security/cve/CVE-2026-5121 REF https://bugzilla.redhat.com/show_bug.cgi?id=2452945 REF https://cert-portal.siemens.com/productcert/html/ssa-585531.html REF https://github.com/advisories/GHSA-2vwv-vqpv-v8vc REF https://github.com/libarchive/libarchive/pull/2934

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy