Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

Summary

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

Timeline

1. Jun 30, 2026, 6:29 AM UTCCVE published
2. Jun 30, 2026, 12:20 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: yes · Technical impact: partial

3. Oct 14, 2026, 7:24 PM UTCRecord last updated

Affected versions

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/cert-manager-trust-manager-rhel9

  Version range not reported

• rhaii/vllm-gaudi-rhel9

  Version range not reported

• rhaii/vllm-spyre-rhel9

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• discovery/discovery-ui-rhel9

  Version range not reported

• libarchive-main

  Version range not reported

• rhai/base-image-rocm-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-cuda-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-rocm-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-cuda-rhel9

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• rhui5/cds-kubernetes-rhel9

  Version range not reported

• rhui5/cds-rhel9

  Version range not reported

• rhui5/haproxy-rhel9

  Version range not reported

• rhui5/installer-rhel9

  Version range not reported

• rhui5/rhua-rhel9

  Version range not reported

• rhui5/cds-kubernetes-tp-rhel9

  Version range not reported

• rhui5/installer-tp-rhel9

  Version range not reported

• rhui5/rhua-tp-rhel9

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

References 25