PT-2026-26290 · Unknown+2 · Libarchive+2

Elhanan Haenel · Published 2026-01-01 · Updated 2026-05-21 · CVE-2026-4426

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive (affected versions not specified)

Description An issue exists in libarchive’s zisofs decompression logic. Improper validation of the pz log2 bs field read from ISO9660 Rock Ridge extensions can lead to undefined behavior. An attacker can exploit this by providing a specially crafted ISO file. This can result in incorrect memory allocation and potential application crashes, leading to a denial-of-service (DoS) condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-1335

Related Identifiers

CVE-2026-4426

ECHO-F87D-FF1F-0CCD

OESA-2026-1940

OESA-2026-1941

OESA-2026-1942

OESA-2026-1943

OESA-2026-1944

OESA-2026-1945

RHSA-2026:8944

USN-8292-1

Affected Products

Linuxmint

Ubuntu

Libarchive

References · 33

• https://github.com/libarchive/libarchive/pull/2897 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-4426 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4426 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-4426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4424 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1944 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5121 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4424 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1942 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-4426 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5121 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4426 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-4426 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-4426 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8292-1 · Vendor Advisory