A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.

According to the versions of the libarchive packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically     within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the     decompression routine may enter a state where internal logic prevents forward progress. This condition     results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum     validation and appears structurally valid, affected applications cannot detect the issue before     processing. This can allow attackers to cause persistent denial-of-service conditions in services that     automatically process archives.(CVE-2026-4111)

    A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression     logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A     remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect     memory allocation and potential application crashes, resulting in a denial-of-service (DoS)     condition.(CVE-2026-4426)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libarchive security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libarchive packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically     within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the     decompression routine may enter a state where internal logic prevents forward progress. This condition     results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum     validation and appears structurally valid, affected applications cannot detect the issue before     processing. This can allow attackers to cause persistent denial-of-service conditions in services that     automatically process archives.(CVE-2026-4111)

    A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression     logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A     remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect     memory allocation and potential application crashes, resulting in a denial-of-service (DoS)     condition.(CVE-2026-4426)

Tenable has extracted the preceding description block directly from the EulerOS libarchive security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:21831-1 advisory.

    This update for libarchive fixes the following issues

    - CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to     infinite loop       and DoS (bsc#1259635).
    - CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).
    - CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs     decompression code       (bsc#1259931).
    - CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20797-1 advisory.

    This update for libarchive fixes the following issues

    - CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to     infinite loop       and DoS (bsc#1259635).
    - CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).
    - CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs     decompression code       (bsc#1259931).
    - CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8292-1 advisory.

    It was discovered that libarchive incorrectly handled certain RAR archives. An attacker could possibly use     this issue to cause an out-of-bounds read via a crafted RAR archive, leading to sensitive memory     disclosure. (CVE-2026-4424)

    It was discovered that libarchive incorrectly handled certain ISO files. An attacker could possibly use     this issue to cause incorrect memory allocation via a crafted ISO file, leading to a denial of service.
    (CVE-2026-4426)

    It was discovered that libarchive incorrectly handled block pointer allocation in zisofs on 32-bit     systems. An attacker could possibly use this issue to cause a heap buffer overflow via a crafted ISO9660     image, possibly leading to arbitrary code execution. (CVE-2026-5121)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021469 advisory.

    A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression     logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A     remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect     memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the libarchive package has been released.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4563 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4563-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                     Arnaud Rebillout     May 05, 2026                                  https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libarchive     Version        : 3.4.3-2+deb11u4     CVE ID         : CVE-2026-4111 CVE-2026-4424 CVE-2026-4426 CVE-2026-5121     Debian Bug     : 1130753 1131444 1131446 1133002

    Multiple vulnerabilities have been discovered in libarchive, a     multi-format archive and compression C library, which also provides the     following command-line tools: bsdcat, bsdcpio, bsdtar and bsdunzip.

    CVE-2026-4111

        A flaw was identified in the RAR5 archive decompression logic of the         libarchive library, specifically within the archive_read_data()         processing path. When a specially crafted RAR5 archive is processed,         the decompression routine may enter a state where internal logic         prevents forward progress.  This condition results in an infinite loop         that continuously consumes CPU resources. Because the archive passes         checksum validation and appears structurally valid, affected         applications cannot detect the issue before processing. This can allow         attackers to cause persistent denial-of-service conditions in services         that automatically process archives.

    CVE-2026-4424

        A flaw was found in libarchive. This heap out-of-bounds read         vulnerability exists in the RAR archive processing logic due to         improper validation of the LZSS sliding window size after transitions         between compression methods. A remote attacker can exploit this by         providing a specially crafted RAR archive, leading to the disclosure         of sensitive heap memory information without requiring authentication         or user interaction.

    CVE-2026-4426

        A flaw was found in libarchive. An Undefined Behavior vulnerability         exists in the zisofs decompression logic, caused by improper         validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge         extensions. A remote attacker can exploit this by supplying a         specially crafted ISO file. This can lead to incorrect memory         allocation and potential application crashes, resulting in a         denial-of-service (DoS) condition.

    CVE-2026-5121

        A flaw was found in libarchive. On 32-bit systems, an integer overflow         vulnerability exists in the zisofs block pointer allocation logic. A         remote attacker can exploit this by providing a specially crafted         ISO9660 image, which can lead to a heap buffer overflow. This could         potentially allow for arbitrary code execution on the affected system.

    For Debian 11 bullseye, these problems have been fixed in version     3.4.3-2+deb11u4.

    We recommend that you upgrade your libarchive packages.

    For the detailed security status of libarchive please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libarchive

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-54ce3fd147 advisory.

    Rebase to the latest upstream version - 3.8.7


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression     logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A     remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect     memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.
    (CVE-2026-4426)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
320749	EulerOS Virtualization 2.13.0 : libarchive (EulerOS-SA-2026-2401)	Nessus	Huawei Local Security Checks	high
320747	EulerOS Virtualization 2.13.1 : libarchive (EulerOS-SA-2026-2372)	Nessus	Huawei Local Security Checks	high
320304	EulerOS 2.0 SP13 : libarchive (EulerOS-SA-2026-2337)	Nessus	Huawei Local Security Checks	high
320302	EulerOS 2.0 SP13 : libarchive (EulerOS-SA-2026-2294)	Nessus	Huawei Local Security Checks	high
317723	SUSE SLES16 Security Update : libarchive (SUSE-SU-2026:21831-1)	Nessus	SuSE Local Security Checks	critical
317652	openSUSE 16 Security Update : libarchive (openSUSE-SU-2026:20797-1)	Nessus	SuSE Local Security Checks	critical
316487	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : libarchive vulnerabilities (USN-8292-1)	Nessus	Ubuntu Local Security Checks	critical
315173	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libarchive (UTSA-2026-021469)	Nessus	Unity Linux Local Security Checks	medium
312349	Photon OS 4.0: Libarchive PHSA-2026-4.0-1007	Nessus	PhotonOS Local Security Checks	critical
312112	Debian dla-4563 : libarchive-dev - security update	Nessus	Debian Local Security Checks	critical
310598	Fedora 44 : libarchive (2026-54ce3fd147)	Nessus	Fedora Local Security Checks	critical
307888	Photon OS 5.0: Libarchive PHSA-2026-5.0-0825	Nessus	PhotonOS Local Security Checks	critical
303063	Linux Distros Unpatched Vulnerability : CVE-2026-4426	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-4426

medium

Tenable Plugins

high

high

high

high

critical

critical

critical

medium

critical

critical

critical

critical

medium