A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow.
This could potentially allow for arbitrary code execution on the affected system.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 8
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Libarchive Libarchive
cpe:2.3:a:libarchive:libarchive:-:*:*:*:*:*:*:*
|
— | — |
|
Redhat Hardened_Images
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
|
— | — |
|
Redhat Openshift_Container_Platform
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
|
— | — |
|
Redhat Enterprise_Linux
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
|
— | — |
|
Redhat Enterprise_Linux
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
|
— | — |
|
Redhat Enterprise_Linux
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
|
— | — |
|
Redhat Enterprise_Linux
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
|
— | — |
|
Redhat Enterprise_Linux
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
|
— | — |
References 38
https://access.redhat.com/security/cve/CVE-2026-5121
secalert@redhat.com
https://github.com/libarchive/libarchive/pull/2934
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:8510
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:8517
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:8521
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:8534
secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2452945
secalert@redhat.com
https://github.com/advisories/GHSA-2vwv-vqpv-v8vc
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:10065
RHSA-2026:10065
https://access.redhat.com/errata/RHSA-2026:10097
RHSA-2026:10097
https://access.redhat.com/errata/RHSA-2026:11768
RHSA-2026:11768
https://access.redhat.com/errata/RHSA-2026:12071
RHSA-2026:12071
https://access.redhat.com/errata/RHSA-2026:12274
RHSA-2026:12274
https://access.redhat.com/errata/RHSA-2026:13812
RHSA-2026:13812
https://access.redhat.com/errata/RHSA-2026:14773
RHSA-2026:14773
https://access.redhat.com/errata/RHSA-2026:14937
RHSA-2026:14937
https://access.redhat.com/errata/RHSA-2026:15087
RHSA-2026:15087
https://access.redhat.com/errata/RHSA-2026:16008
RHSA-2026:16008
https://access.redhat.com/errata/RHSA-2026:16009
RHSA-2026:16009
https://access.redhat.com/errata/RHSA-2026:16030
RHSA-2026:16030
https://access.redhat.com/errata/RHSA-2026:16174
RHSA-2026:16174
https://access.redhat.com/errata/RHSA-2026:17596
RHSA-2026:17596
https://access.redhat.com/errata/RHSA-2026:19724
RHSA-2026:19724
https://access.redhat.com/errata/RHSA-2026:19725
RHSA-2026:19725
https://access.redhat.com/errata/RHSA-2026:20040
RHSA-2026:20040
https://access.redhat.com/errata/RHSA-2026:21690
RHSA-2026:21690
https://access.redhat.com/errata/RHSA-2026:25096
RHSA-2026:25096
https://access.redhat.com/errata/RHSA-2026:8864
RHSA-2026:8864
https://access.redhat.com/errata/RHSA-2026:8866
RHSA-2026:8866
https://access.redhat.com/errata/RHSA-2026:8867
RHSA-2026:8867
https://access.redhat.com/errata/RHSA-2026:8873
RHSA-2026:8873
https://access.redhat.com/errata/RHSA-2026:8908
RHSA-2026:8908
https://access.redhat.com/errata/RHSA-2026:8944
RHSA-2026:8944
https://access.redhat.com/errata/RHSA-2026:9026
RHSA-2026:9026
https://access.redhat.com/errata/RHSA-2026:9592
RHSA-2026:9592
https://access.redhat.com/errata/RHSA-2026:9832
RHSA-2026:9832
https://cert-portal.siemens.com/productcert/html/ssa-585531.html
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
https://access.redhat.com/errata/RHSA-2026:72502
RHSA-2026:72502