What’s Vulnerable › Vulnerabilities

CVE-2026-14164: Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

Description

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

Affected products

How to fix

Upgrade to a fixed version: Red Hat Cert Manager support for Red Hat OpenShift release 1.17 1791371080; Red Hat Cert Manager support for Red Hat OpenShift release 1.18 1791459707; Red Hat Cert Manager support for Red Hat OpenShift release 1.20 1790223279; Red Hat OpenShift Container Platform 4.18 418.94.202609031320-0; Red Hat AI Inference Server 3.5 1791427182; Red Hat Discovery 2 1786638573; Red Hat Enterprise Linux 10 0:3.7.7-10.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.7.7-5.el10_0.1; Red Hat Enterprise Linux 9 0:3.5.3-11.el9_8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:3.5.3-5.el9_2.3; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:3.5.3-5.el9_4.2; Red Hat Enterprise Linux 9.6 Extended Update Support 0:3.5.3-7.el9_6.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-14164 or the next vulnerability affects your stack