A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-54ce3fd147 advisory.

    Rebase to the latest upstream version - 3.8.7


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libarchive package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression     logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A     remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect     memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.
    (CVE-2026-4426)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310598	Fedora 44 : libarchive (2026-54ce3fd147)	Nessus	Fedora Local Security Checks	critical
307888	Photon OS 5.0: Libarchive PHSA-2026-5.0-0825	Nessus	PhotonOS Local Security Checks	critical
303063	Linux Distros Unpatched Vulnerability : CVE-2026-4426	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-4426

medium

Tenable Plugins

critical

critical

medium