7.5

CVE-2026-14164

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 10
Default Statusaffected
Version 0:3.7.7-10.el10_2
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 10.0 Extended Update Support
Default Statusaffected
Version 0:3.7.7-5.el10_0.1
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9
Default Statusaffected
Version 0:3.5.3-11.el9_8
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9
Default Statusaffected
Version 0:3.5.3-11.el9_8
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.22
Default Statusaffected
Version 4.22.9.8.202608130832-0
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Discovery 2
Default Statusaffected
Version 1786638573
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Hardened Images
Default Statusaffected
Version 3.8.8-2.hum1
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1786435241
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1786533457
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1786533449
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1786435483
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1786533529
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 6
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 7
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 8
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4
Default Statusaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.389
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-415 Double Free

The product calls free() twice on the same memory address.

https://bugzilla.redhat.com/show_bug.cgi?id=2493411
https://github.com/libarchive/libarchive/issues/3069
https://github.com/libarchive/libarchive/pull/3071
https://access.redhat.com/errata/RHSA-2026:30333
https://access.redhat.com/errata/RHSA-2026:52674
https://access.redhat.com/errata/RHSA-2026:52675
https://access.redhat.com/security/cve/CVE-2026-14164
https://access.redhat.com/errata/RHSA-2026:54387
https://access.redhat.com/errata/RHSA-2026:54760
https://access.redhat.com/errata/RHSA-2026:54769
https://access.redhat.com/errata/RHSA-2026:56954