Red Hat Enterprise Linux 10 EUVD-2026-19705

CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H indicates local attack vector with low complexity and required user interaction, but high availability impact (complete process crash). The score of 5.5 is moderate. Real-world risk depends on deployment context: systems where untrusted archives are processed without sandboxing (e.g., automated backup restoration, container image unpacking) face higher practical risk. The requirement for user interaction (UI:R) to open/extract a malicious archive reduces attack surface compared to remote network-based DoS. The absence of confidentiality or integrity impact limits scope. No EPSS data, KEV confirmation, or public exploit code provided; therefore exploitation probability cannot be quantified beyond the CVSS confidence level. SSVC perspective: exploitation is feasible (proof-of-concept-level simplicity: craft malformed ACL in archive), technical impact is high (process crash), but automatable deployments are limited to specific use cases. Prioritize patching on systems that routinely process untrusted archives (backup servers, container image registries) before general-purpose systems.

An attacker crafts a malicious TAR or ZIP archive containing a file with metadata including a malformed ACL entry-for example, an extended attributes or ACL header field containing the bare string 'd' or 'default' without trailing field delimiters. When a user or automated system (backup restore script, container image extraction tool) opens this archive using bsdtar or another libarchive-linked application, the archive_acl_from_text_nl() parser processes the malformed ACL, fails to validate the presence of subsequent fields, and dereferences a NULL pointer, crashing the application. No special privileges are required from the attacker (PR:N), but the victim must interact with the archive (UI:R). The result is denial of service of the affected application process.