A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
History

Wed, 09 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.19::el9
References

Tue, 08 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.21::el9
References

Tue, 08 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.20::el9
References

Tue, 01 Sep 2026 02:45:00 +0000

Type Values Removed Values Added
References

Mon, 31 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4

Tue, 25 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
References

Mon, 24 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4

Mon, 24 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/o:redhat:rhel_eus:9.6::baseos
Vendors & Products Redhat rhel Eus
References

Mon, 24 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/a:redhat:rhel_e4s:9.4::appstream
cpe:/o:redhat:rhel_e4s:9.2::baseos
cpe:/o:redhat:rhel_e4s:9.4::baseos
Vendors & Products Redhat rhel E4s
References

Fri, 21 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4

Wed, 19 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
CPEs cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
References

Tue, 18 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4 cpe:/a:redhat:openshift:4.22::el9
References

Thu, 13 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat discovery
CPEs cpe:/a:redhat:discovery:2::el9
Vendors & Products Redhat discovery
References

Wed, 12 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhui
CPEs cpe:/a:redhat:rhui:5::el9
Vendors & Products Redhat rhui
References

Mon, 10 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
References

Mon, 10 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References

Wed, 01 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Libarchive
Libarchive libarchive
Red Hat
Red Hat enterprise Linux
Redhat hardened Images
Redhat openshift Container Platform
Vendors & Products Libarchive
Libarchive libarchive
Red Hat
Red Hat enterprise Linux
Redhat hardened Images
Redhat openshift Container Platform

Tue, 30 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
References

Tue, 30 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 30 Jun 2026 07:15:00 +0000

Type Values Removed Values Added
Description A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
Title Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
Weaknesses CWE-415
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2026-06-30T06:29:23.549Z

Updated: 2026-09-09T16:03:48.644Z

Reserved: 2026-06-30T05:30:04.144Z

Link: CVE-2026-14164

cve-icon Vulnrichment

Updated: 2026-06-30T12:20:11.389Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-06-30T07:16:32.170

Modified: 2026-09-09T17:17:15.903

Link: CVE-2026-14164

cve-icon Redhat

No data.