Three vulnerabilities in libarchive expose systems to denial-of-service and potential arbitrary code execution via crafted archive files: a double-free in RAR5 handling (CVE-2026-14164, CVSS 7.5 HIGH), a tar-specific buffer overflow (CVE-2026-15028, CVSS 3.9 LOW), and improper ACL validation (CVE-2026-5745, CVSS 5.5 MEDIUM). The tar buffer overflow only affects Ubuntu 26.04 LTS, while the ACL vulnerability affects libarchive up to an unspecified version and several Red Hat products including Enterprise Linux 6.0 and 7.0. Specific fixed version numbers and workarounds are not provided in the available information.
It was discovered that libarchive did not properly manage memory when unpacking certain RAR5 archives, leading to a double free. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-14164) It was discovered that libarchive did not properly validate certain tar archives, leading to a buffer overflow. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15028) It was discovered that libarchive did not properly validate certain malformed ACL entries. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-5745)