CVE-2026-4426

MEDIUM

Libarchive: libarchive: denial of service via malformed iso file processing

Title source: cna

Description

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.

References (4)

Core 4

Core References

https://github.com/libarchive/libarchive/pull/2897

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:8944

https://access.redhat.com/errata/RHSA-2026:8944

Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2026-4426

Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat

RHBZ#2449010

https://bugzilla.redhat.com/show_bug.cgi?id=2449010

Scores

CVSS v3 6.5

EPSS 0.0031

EPSS Percentile 22.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-1335

Status published

Products (16)

libarchive/libarchive

Red Hat/Red Hat Enterprise Linux 10

Red Hat/Red Hat Enterprise Linux 6

Red Hat/Red Hat Enterprise Linux 7

Red Hat/Red Hat Enterprise Linux 8

Red Hat/Red Hat Enterprise Linux 9

Red Hat/Red Hat Hardened Images

Red Hat/Red Hat Hardened Images 3.8.7-1.hum1

Red Hat/Red Hat OpenShift Container Platform 4

redhat/enterprise_linux 6.0

... and 6 more

Published Mar 19, 2026

Tracked Since Mar 19, 2026