CVE-2026-5121 PUBLISHED

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

Assigner: redhat
Reserved: 30.03.2026 Published: 30.03.2026 Updated: 30.03.2026

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected

Workarounds

To mitigate this issue, avoid processing untrusted ISO9660 images with applications that utilize libarchive. Users should only extract or read content from ISO images obtained from trusted sources.

Credits

  • Red Hat would like to thank Elhanan Haenel for reporting this issue.

References