A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

An update of the libarchive package has been released.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4563 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4563-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                     Arnaud Rebillout     May 05, 2026                                  https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libarchive     Version        : 3.4.3-2+deb11u4     CVE ID         : CVE-2026-4111 CVE-2026-4424 CVE-2026-4426 CVE-2026-5121     Debian Bug     : 1130753 1131444 1131446 1133002

    Multiple vulnerabilities have been discovered in libarchive, a     multi-format archive and compression C library, which also provides the     following command-line tools: bsdcat, bsdcpio, bsdtar and bsdunzip.

    CVE-2026-4111

        A flaw was identified in the RAR5 archive decompression logic of the         libarchive library, specifically within the archive_read_data()         processing path. When a specially crafted RAR5 archive is processed,         the decompression routine may enter a state where internal logic         prevents forward progress.  This condition results in an infinite loop         that continuously consumes CPU resources. Because the archive passes         checksum validation and appears structurally valid, affected         applications cannot detect the issue before processing. This can allow         attackers to cause persistent denial-of-service conditions in services         that automatically process archives.

    CVE-2026-4424

        A flaw was found in libarchive. This heap out-of-bounds read         vulnerability exists in the RAR archive processing logic due to         improper validation of the LZSS sliding window size after transitions         between compression methods. A remote attacker can exploit this by         providing a specially crafted RAR archive, leading to the disclosure         of sensitive heap memory information without requiring authentication         or user interaction.

    CVE-2026-4426

        A flaw was found in libarchive. An Undefined Behavior vulnerability         exists in the zisofs decompression logic, caused by improper         validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge         extensions. A remote attacker can exploit this by supplying a         specially crafted ISO file. This can lead to incorrect memory         allocation and potential application crashes, resulting in a         denial-of-service (DoS) condition.

    CVE-2026-5121

        A flaw was found in libarchive. On 32-bit systems, an integer overflow         vulnerability exists in the zisofs block pointer allocation logic. A         remote attacker can exploit this by providing a specially crafted         ISO9660 image, which can lead to a heap buffer overflow. This could         potentially allow for arbitrary code execution on the affected system.

    For Debian 11 bullseye, these problems have been fixed in version     3.4.3-2+deb11u4.

    We recommend that you upgrade your libarchive packages.

    For the detailed security status of libarchive please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libarchive

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libarchive installed on the remote host is prior to 3.1.2-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3257 advisory.

    A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs     block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted     ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code     execution on the affected system. (CVE-2026-5121)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-54ce3fd147 advisory.

    Rebase to the latest upstream version - 3.8.7


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9592 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-475:03 advisory.

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)
      * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9026 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8866 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:8534 advisory.

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)
      * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8873 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8867 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8908 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8864 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-455:02 advisory.

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)
      * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:8510 advisory.

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:8534 advisory.

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-8534 advisory.

    - Resolves: CVE-2026-4424

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-8510 advisory.

    - Resolves: CVE-2026-4424
    - Resolves: CVE-2026-5121

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:8510 advisory.

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)
      * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8521 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8534 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8517 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8510 advisory.

    The libarchive programming library can create and read several different streaming archive formats,     including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,     scripting language bindings such as python-libarchive, and several popular desktop file managers.

    Security Fix(es):

    * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing     (CVE-2026-4424)

    * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing     (CVE-2026-5121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs     block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted     ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code     execution on the affected system. (CVE-2026-5121)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
312349	Photon OS 4.0: Libarchive PHSA-2026-4.0-1007	Nessus	PhotonOS Local Security Checks	critical
312112	Debian dla-4563 : libarchive-dev - security update	Nessus	Debian Local Security Checks	critical
311202	Amazon Linux 2 : libarchive, --advisory ALAS2-2026-3257 (ALAS-2026-3257)	Nessus	Amazon Linux Local Security Checks	critical
310598	Fedora 44 : libarchive (2026-54ce3fd147)	Nessus	Fedora Local Security Checks	critical
309106	RHEL 8 : libarchive (RHSA-2026:9592)	Nessus	Red Hat Local Security Checks	critical
307888	Photon OS 5.0: Libarchive PHSA-2026-5.0-0825	Nessus	PhotonOS Local Security Checks	critical
307682	MiracleLinux 8 : libarchive-3.3.3-7.el8_10 (AXSA:2026-475:03)	Nessus	Miracle Linux Local Security Checks	critical
307601	RHEL 8 : libarchive (RHSA-2026:9026)	Nessus	Red Hat Local Security Checks	critical
307563	RHEL 9 : libarchive (RHSA-2026:8866)	Nessus	Red Hat Local Security Checks	critical
307561	AlmaLinux 8 : libarchive (ALSA-2026:8534)	Nessus	Alma Linux Local Security Checks	critical
307543	RHEL 9 : libarchive (RHSA-2026:8873)	Nessus	Red Hat Local Security Checks	critical
307525	RHEL 9 : libarchive (RHSA-2026:8867)	Nessus	Red Hat Local Security Checks	critical
307524	RHEL 8 : libarchive (RHSA-2026:8908)	Nessus	Red Hat Local Security Checks	critical
307520	RHEL 9 : libarchive (RHSA-2026:8864)	Nessus	Red Hat Local Security Checks	critical
307497	MiracleLinux 9 : libarchive-3.5.3-9.el9_7 (AXSA:2026-455:02)	Nessus	Miracle Linux Local Security Checks	critical
307477	RockyLinux 9 : libarchive (RLSA-2026:8510)	Nessus	Rocky Linux Local Security Checks	critical
307467	RockyLinux 8 : libarchive (RLSA-2026:8534)	Nessus	Rocky Linux Local Security Checks	critical
307382	Oracle Linux 8 : libarchive (ELSA-2026-8534)	Nessus	Oracle Linux Local Security Checks	critical
307380	Oracle Linux 9 : libarchive (ELSA-2026-8510)	Nessus	Oracle Linux Local Security Checks	critical
307375	AlmaLinux 9 : libarchive (ALSA-2026:8510)	Nessus	Alma Linux Local Security Checks	critical
306789	RHEL 8 : libarchive (RHSA-2026:8521)	Nessus	Red Hat Local Security Checks	critical
306785	RHEL 8 : libarchive (RHSA-2026:8534)	Nessus	Red Hat Local Security Checks	critical
306784	RHEL 7 : libarchive (RHSA-2026:8517)	Nessus	Red Hat Local Security Checks	critical
306774	RHEL 9 : libarchive (RHSA-2026:8510)	Nessus	Red Hat Local Security Checks	critical
304358	Linux Distros Unpatched Vulnerability : CVE-2026-5121	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-5121

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical