7.5

CVE-2026-14164

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 10
Default Statusaffected
Version 0:3.7.7-10.el10_2
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 10.0 Extended Update Support
Default Statusaffected
Version 0:3.7.7-5.el10_0.1
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9
Default Statusaffected
Version 0:3.5.3-11.el9_8
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9
Default Statusaffected
Version 0:3.5.3-11.el9_8
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Default Statusaffected
Version 0:3.5.3-5.el9_2.3
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Default Statusaffected
Version 0:3.5.3-5.el9_4.2
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9.6 Extended Update Support
Default Statusaffected
Version 0:3.5.3-7.el9_6.2
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.13
Default Statusaffected
Version 413.92.202609080414-0
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.14
Default Statusaffected
Version 414.92.202609011250-0
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.15
Default Statusaffected
Version 415.92.202609140326-0
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.16
Default Statusaffected
Version 416.94.202609140240-0
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.17
Default Statusaffected
Version 417.94.202609191027-0
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.18
Default Statusaffected
Version 418.94.202609031320-0
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.18
Default Statusaffected
Version 418.94.202609171815-0
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.19
Default Statusaffected
Version 4.19.9.6.202609021231-0
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.20
Default Statusaffected
Version 4.20.9.6.202609021029-0
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.21
Default Statusaffected
Version 4.21.9.6.202609021100-0
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.22
Default Statusaffected
Version 4.22.9.8.202608130832-0
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Cert Manager support for Red Hat OpenShift release 1.20
Default Statusaffected
Version 1790223279
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Cert Manager support for Red Hat OpenShift release 1.20
Default Statusaffected
Version 1790223719
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Cert Manager support for Red Hat OpenShift release 1.20
Default Statusaffected
Version 1790272426
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Cert Manager support for Red Hat OpenShift release 1.20
Default Statusaffected
Version 1790589998
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Cert Manager support for Red Hat OpenShift release 1.20
Default Statusaffected
Version 1790589912
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Cert Manager support for Red Hat OpenShift release 1.20
Default Statusaffected
Version 1790589914
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Cert Manager support for Red Hat OpenShift release 1.20
Default Statusaffected
Version 1790589855
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Cert Manager support for Red Hat OpenShift release 1.20
Default Statusaffected
Version 1790598593
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Discovery 2
Default Statusaffected
Version 1786638573
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Discovery 2
Default Statusaffected
Version 1788206196
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Hardened Images
Default Statusaffected
Version 3.8.8-2.hum1
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.0
Default Statusaffected
Version 1790276886
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.0
Default Statusaffected
Version 1790276884
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.0
Default Statusaffected
Version 1790277045
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.0
Default Statusaffected
Version 1790276889
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.0
Default Statusaffected
Version 1790276974
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.2
Default Statusaffected
Version 1790703497
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.2
Default Statusaffected
Version 1790703506
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.2
Default Statusaffected
Version 1790703590
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.2
Default Statusaffected
Version 1790703568
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.2
Default Statusaffected
Version 1790703586
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.2
Default Statusaffected
Version 1790703494
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift AI 3.4
Default Statusaffected
Version 1790703542
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1786435241
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1786533457
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1786533449
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1786435483
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1786533529
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1787241211
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1787135742
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Update Infrastructure 5
Default Statusaffected
Version 1787241260
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 6
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 7
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 8
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4
Default Statusunaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.389
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-415 Double Free

The product calls free() twice on the same memory address.

https://bugzilla.redhat.com/show_bug.cgi?id=2493411
https://github.com/libarchive/libarchive/issues/3069
https://github.com/libarchive/libarchive/pull/3071
https://access.redhat.com/errata/RHSA-2026:30333
https://access.redhat.com/errata/RHSA-2026:52674
https://access.redhat.com/errata/RHSA-2026:52675
https://access.redhat.com/security/cve/CVE-2026-14164
https://access.redhat.com/errata/RHSA-2026:54387
https://access.redhat.com/errata/RHSA-2026:54760
https://access.redhat.com/errata/RHSA-2026:54769
https://access.redhat.com/errata/RHSA-2026:56954
https://access.redhat.com/errata/RHSA-2026:58558
https://access.redhat.com/errata/RHSA-2026:58573
https://access.redhat.com/errata/RHSA-2026:58574
https://access.redhat.com/errata/RHSA-2026:58981
https://access.redhat.com/errata/RHSA-2026:61783
https://access.redhat.com/errata/RHSA-2026:63100
https://access.redhat.com/errata/RHSA-2026:63041
https://access.redhat.com/errata/RHSA-2026:63044
https://access.redhat.com/errata/RHSA-2026:62409
https://access.redhat.com/errata/RHSA-2026:65851
https://access.redhat.com/errata/RHSA-2026:65839
https://access.redhat.com/errata/RHSA-2026:67935
https://access.redhat.com/errata/RHSA-2026:67857
https://access.redhat.com/errata/RHSA-2026:72394
https://access.redhat.com/errata/RHSA-2026:72395
https://access.redhat.com/errata/RHSA-2026:72399
https://access.redhat.com/errata/RHSA-2026:72470
https://access.redhat.com/errata/RHSA-2026:72475
https://access.redhat.com/errata/RHSA-2026:72476
https://access.redhat.com/errata/RHSA-2026:72502
https://access.redhat.com/errata/RHSA-2026:73909
https://access.redhat.com/errata/RHSA-2026:73959
https://access.redhat.com/errata/RHSA-2026:73960
https://access.redhat.com/errata/RHSA-2026:73961
https://access.redhat.com/errata/RHSA-2026:73962
https://access.redhat.com/errata/RHSA-2026:70586
https://access.redhat.com/errata/RHSA-2026:74458
https://access.redhat.com/errata/RHSA-2026:74459
https://access.redhat.com/errata/RHSA-2026:74460
https://access.redhat.com/errata/RHSA-2026:74461
https://access.redhat.com/errata/RHSA-2026:74462
https://access.redhat.com/errata/RHSA-2026:74463
https://access.redhat.com/errata/RHSA-2026:70615
https://access.redhat.com/errata/RHSA-2026:74674