Riskcovery

CVE-2026-5121

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

State
Published
Severity
7.5 High
Published
Mar 30, 2026
Updated
Oct 14, 2026
Reserved
Mar 30, 2026

Read the record on cve.org

Description

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nredhat
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

  • CWE-190 Integer Overflow or Wraparound

Affected Products

ProductVersions
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat
  • 0:3.1.2-14.el7_9.2 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:3.3.3-7.el8_10 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat
  • 0:3.3.2-8.el8_2.2 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat
  • 0:3.3.3-1.el8_4.2 and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat
  • 0:3.3.3-1.el8_4.2 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat
  • 0:3.3.3-6.el8_6.1 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat
  • 0:3.3.3-6.el8_6.1 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat
  • 0:3.3.3-6.el8_6.1 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat
  • 0:3.3.3-5.el8_8.2 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat
  • 0:3.3.3-5.el8_8.2 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:3.5.3-9.el9_7 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:3.5.3-9.el9_7 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat
  • 0:3.5.3-2.el9_0.4 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat
  • 0:3.5.3-5.el9_2.2 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat
  • 0:3.5.3-5.el9_4 and laterNot affected
Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat
  • 0:3.5.3-7.el9_6.1 and laterNot affected
Red Hat OpenShift Container Platform 4.12Red Hat
  • 412.86.202604281506-0 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat
  • 413.92.202605271328-0 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat
  • 414.92.202605060243-0 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat
  • 415.92.202605060220-0 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat
  • 416.94.202604211449-0 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat
  • 417.94.202605112123-0 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat
  • 418.94.202604240015-0 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat
  • 4.19.9.6.202605201155-0 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat
  • 7.13.5-4.1777325677 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat
  • 7.13.5-4.1777325711 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat
  • 7.13.5-4.1777325710 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat
  • 7.13.5-3.1777325680 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat
  • 7.13.5-4.1777325709 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat
  • 7.13.5-4.1777325680 and laterNot affected
RHEL-8 based Middleware ContainersRed Hat
  • 7.13.5-4.1777325708 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.17Red Hat
  • 1791371080 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.17Red Hat
  • 1791371069 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.17Red Hat
  • 1791788287 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.17Red Hat
  • 1791970484 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.18Red Hat
  • 1791459707 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.18Red Hat
  • 1791459711 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.18Red Hat
  • 1791459759 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.18Red Hat
  • 1789029076 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.18Red Hat
  • 1791966259 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.20Red Hat
  • 1790598593 and laterNot affected
Red Hat AI Inference Server 3.2Red Hat
  • 1779223654 and laterNot affected
Red Hat AI Inference Server 3.2Red Hat
  • 1779223651 and laterNot affected
Red Hat AI Inference Server 3.2Red Hat
  • 1780681984 and laterNot affected
Red Hat AI Inference Server 3.3Red Hat
  • 1778244559 and laterNot affected
Red Hat AI Inference Server 3.3Red Hat
  • 1778244531 and laterNot affected
Red Hat AI Inference Server 3.3Red Hat
  • 1778274666 and laterNot affected
Red Hat AI Inference Server 3.3Red Hat
  • 1778244546 and laterNot affected
Red Hat Discovery 2Red Hat
  • 1778156756 and laterNot affected
Red Hat Hardened ImagesRed Hat
  • 3.8.7-1.hum1 and laterNot affected
Red Hat Insights proxy 1.5Red Hat
  • 1776868961 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1776868774 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1776868744 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1776868772 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1776868842 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1777459441 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1777454300 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1777459504 and laterNot affected
Red Hat Enterprise Linux 10Red Hat
    Red Hat Enterprise Linux 6Red Hat

      References

      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.