CVE-2026-14164: Double-Free in libarchive RAR5 Reader – Denial of Service

Technical summary

The vulnerability resides in libarchive's RAR5 reader implementation. During unpacking state reinitialization triggered by processing a malformed RAR5 archive, the filtered_buf pointer is freed but not set to NULL. If a subsequent archive entry is processed, the code may attempt to free the same pointer again without checking whether it has already been deallocated. This classic double-free scenario (CWE-415) corrupts heap metadata and typically causes the application to crash when memory allocators detect the anomaly. The flaw is present in the RAR5-specific parsing logic and does not affect other archive formats supported by libarchive.

Business impact

Denial of service is the primary business impact. Any service, tool, or workflow that automatically extracts or processes RAR5 archives using libarchive becomes vulnerable to unexpected crashes if fed a malicious file. This includes backup systems, file managers, antivirus scanning engines, and security tools that rely on archive extraction for inspection. Repeated crashes can degrade availability and user experience; attackers may weaponize this to disrupt operations without gaining system access. Organizations that depend on libarchive for critical archive handling should prioritize patching to maintain service reliability.

Affected systems

libarchive is a foundational library used by numerous applications and projects across Linux, BSD, macOS, and Windows platforms. Any software or service that depends on libarchive for RAR5 archive support—including but not limited to archive managers, backup utilities, malware analysis tools, and content delivery systems—is potentially affected. The vulnerability does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no widespread active exploitation at publication, but the simplicity of triggering a crash makes it a low-barrier target if weaponized. Verify your organization's specific software inventory against libarchive dependencies.

Exploitability

Exploitability is straightforward for attackers with modest skill. A malicious RAR5 file can be crafted to trigger the double-free condition; no special privileges, user interaction complexity, or authentication are required. The vulnerability can be triggered remotely by hosting a malicious archive and inducing a target application to process it, or by embedding it in email or file-sharing scenarios. However, exploitation results only in denial of service (application crash), not code execution or privilege escalation, which limits the attacker's capability to cause persistent system harm. The low barrier to crash induction makes this a moderate-to-high concern for availability-sensitive operations.

Remediation

Apply a patch from the libarchive project that addresses the double-free condition in RAR5 parsing. This typically involves ensuring the filtered_buf pointer is properly initialized or nullified after deallocation, and adding defensive checks before subsequent free operations. After patching libarchive itself, all dependent applications and services should be restarted to load the updated library. Organizations without immediate patching capability should consider disabling RAR5 processing if possible, implementing network-level filtering to block suspicious archive files, and monitoring for application crashes that may indicate exploitation attempts.

Patch guidance

Consult the libarchive project's official advisories and release notes for the specific version that patches CVE-2026-14164. Most Linux distributions will provide libarchive updates through their standard package managers; apply these updates as part of regular security maintenance. For custom or statically-linked applications, you may need to rebuild against a patched libarchive version. Test patched versions in a non-production environment first to ensure compatibility with dependent applications. Verify that all running services and tools that link to libarchive are restarted after the library upgrade to ensure they load the patched version.

Detection guidance

Monitor application logs and system messages for unexpected crashes or segmentation faults in processes that handle RAR5 archives. Intrusion detection and endpoint protection tools may flag the creation of malicious RAR5 files during reconnaissance or attack staging. Network-based detection is limited; focus on behavioral monitoring—e.g., detecting repeated crash-and-restart cycles in archive processing services. File integrity monitoring and sandboxed testing of suspicious RAR5 files can help identify attack attempts before production exposure. Log all archive extraction operations and correlate crashes with specific file sources to identify attack vectors.

Why prioritize this

This vulnerability merits prompt patching because (1) RAR5 is a relatively modern archive format that may see increasing use in data workflows, (2) the attack vector is remote and unauthenticated, (3) the exploitability bar is low, and (4) while impact is limited to denial of service, availability disruption can cascade through automated systems and workflows. Organizations with critical archive processing pipelines or those exposed to untrusted archive uploads should prioritize this above lower-exploitability flaws. Absence from the KEV catalog does not diminish its practical risk—it reflects current exploitation data, not inherent severity.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH severity) reflects a network-accessible, low-complexity vulnerability with no privilege requirement and no user interaction needed. The attack vector is unauthenticated and requires only crafting a malicious archive file. However, the impact scope is limited to availability (denial of service via crash); there is no confidentiality or integrity impact. The high score appropriately weights the ease of exploitation and the universal reliance on libarchive, while the lack of data theft or system compromise prevents a critical rating. Organizations should treat this as a high-priority patch despite the limited scope of impact.

Frequently asked questions