PT-2026-28808 · Unknown+4 · Libarchive+4

Carnil · Publicado 2026-01-01 · Atualizado 2026-05-28 · CVE-2026-5121

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libarchive (affected versions not specified)

Description An integer overflow exists in the zisofs block pointer allocation logic on 32-bit systems. A remote attacker can exploit this by providing a specially crafted ISO9660 image, potentially leading to a heap buffer overflow and arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALSA-2026:8510

ALSA-2026:8534

BDU:2026-07332

CVE-2026-5121

ECHO-FE78-E324-D857

OESA-2026-1940

OESA-2026-1941

OESA-2026-1942

OESA-2026-1943

OESA-2026-1944

OESA-2026-1945

RHSA-2026:8510

RHSA-2026:8517

RHSA-2026:8521

RHSA-2026:8534

RHSA-2026:8864

RHSA-2026:8866

RHSA-2026:8867

RHSA-2026:8873

RHSA-2026:8908

RHSA-2026:8944

RHSA-2026:9026

RHSA-2026:9592

USN-8292-1

Produtos afetados

Linuxmint

Red Os

Rocky Linux

Ubuntu

Libarchive

Referências · 84

• https://github.com/libarchive/libarchive/pull/2934 · Correção
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1941 · Nota
• https://access.redhat.com/errata/RHSA-2026:9592 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-4426 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:9026 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:10097 · Aviso do Fabricante
• https://bugzilla.redhat.com/2449006 · Nota
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1945 · Nota
• https://ubuntu.com/security/CVE-2026-4424 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:8510 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:16030 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2039025023688827075 · Publicação no Twitter
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-libarchive-cve-2026-5121-8.0 · Nota
• https://access.redhat.com/errata/RHSA-2026:8864 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:8521 · Aviso do Fabricante