PT-2026-28808 · Unknown+4 · Libarchive+4

Carnil · CVE-2026-5121 · Published 2026-01-01 · Updated 2026-07-03

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libarchive (affected versions not specified)

Description An integer overflow exists in the zisofs block pointer allocation logic on 32-bit systems. A remote attacker can exploit this by providing a specially crafted ISO9660 image, potentially leading to a heap buffer overflow and arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2026:8510

ALSA-2026:8534

BDU:2026-07332

CVE-2026-5121

ECHO-FE78-E324-D857

OESA-2026-1940

OESA-2026-1941

OESA-2026-1942

OESA-2026-1943

OESA-2026-1944

OESA-2026-1945

RHSA-2026:8510

RHSA-2026:8517

RHSA-2026:8521

RHSA-2026:8534

RHSA-2026:8864

RHSA-2026:8866

RHSA-2026:8867

RHSA-2026:8873

RHSA-2026:8908

RHSA-2026:8944

RHSA-2026:9026

RHSA-2026:9592

SUSE-SU-2026:22241-1

SUSE-SU-2026:22248-1

SUSE-SU-2026:2490-1

SUSE-SU-2026:2599-1

SUSE-SU-2026:2747-1

USN-8292-1

Affected Products

Linuxmint

Red Os

Rocky Linux

Ubuntu

Libarchive

References · 106

• https://github.com/libarchive/libarchive/pull/2934 · Patch
• https://access.redhat.com/errata/RHSA-2026:8867 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-8534.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:13812 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:10097 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:20040 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:9592 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:8873 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1941 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:16009 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:11768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4424 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:22248-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:16174 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:8521 · Vendor Advisory