PT-2026-26290 · Unknown+2 · Libarchive+2

Elhanan Haenel · Publicado 2026-01-01 · Atualizado 2026-05-21 · CVE-2026-4426

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive (affected versions not specified)

Description An issue exists in libarchive’s zisofs decompression logic. Improper validation of the pz log2 bs field read from ISO9660 Rock Ridge extensions can lead to undefined behavior. An attacker can exploit this by providing a specially crafted ISO file. This can result in incorrect memory allocation and potential application crashes, leading to a denial-of-service (DoS) condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-1335

Identificadores relacionados

CVE-2026-4426

ECHO-F87D-FF1F-0CCD

OESA-2026-1940

OESA-2026-1941

OESA-2026-1942

OESA-2026-1943

OESA-2026-1944

OESA-2026-1945

RHSA-2026:8944

USN-8292-1

Produtos afetados

Linuxmint

Ubuntu

Libarchive

Referências · 33

• https://github.com/libarchive/libarchive/pull/2897 · Correção
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1941 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-4426 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-4426 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2036024209152086182 · Publicação no Twitter
• https://access.redhat.com/security/cve/CVE-2026-4426 · Nota
• https://security-tracker.debian.org/tracker/CVE-2026-4426 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-4424 · Nota de Segurança
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1940 · Nota
• https://osv.dev/vulnerability/OESA-2026-1944 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1943 · Nota
• https://ubuntu.com/security/CVE-2026-5121 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1945 · Nota
• https://ubuntu.com/security/CVE-2026-4424 · Aviso do Fabricante
• https://docs.bell-sw.com/security/cves/CVE-2026-4426 · Nota