CVE-2026-15028: Libarchive Heap Overflow in PAX Header Parsing

Technical summary

CVE-2026-15028 is a heap buffer overflow vulnerability in libarchive triggered during PAX extended header parsing. The flaw resides in the library's handling of the SUN.holesdata sparse-file attribute within tar archives. Exploitation requires a specially crafted tar file and occurs when the attribute contains malformed data that violates expected buffer boundaries. The vulnerability maps to CWE-122 (Heap-based Buffer Overflow) and CWE-805 (Buffer Access with Incorrect Length Value), indicating improper bounds checking during header field processing.

Business impact

The primary business risk is denial of service: if libarchive processes are critical to your infrastructure (backup systems, software distribution, artifact extraction), a successful exploitation could interrupt operations. The secondary risk—arbitrary code execution—would be more severe but requires specific conditions to realize. Organizations relying on libarchive for automated archive processing, containerized deployments, or CI/CD pipelines should assess whether untrusted or user-supplied tar files pass through affected versions without validation.

Affected systems

Libarchive is widely used across UNIX/Linux systems, macOS, and software ecosystems that depend on tar archive handling. The vulnerability affects libarchive library users; specific product versions are not detailed in the available advisory. You must consult your vendor's security bulletins and libarchive's official changelog to identify which versions are vulnerable. Applications embedding or wrapping libarchive—such as backup utilities, package managers, and container tools—inherit this risk if running unpatched versions.

Exploitability

Exploitation is constrained by the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L), which indicates local attack vector, low complexity, and requirement for low privilege plus user interaction. An attacker cannot remotely trigger this flaw; they must first gain local system access and convince a user to open a malicious tar file. The low CVSS score (3.9) reflects these barriers. While remote code execution is theoretically possible, the practical exploitation path is narrow, making this a lower-priority threat compared to remotely exploitable heap overflows.

Remediation

Update libarchive to a patched version released after the vulnerability's discovery (check the official libarchive project repository and your OS/vendor security advisories for specific version numbers). For systems where immediate patching is infeasible, restrict access to archive processing to trusted users, implement file validation before extraction, and monitor for unusual tar files in your environment. If libarchive is embedded in third-party software, verify that vendors have released security updates.

Patch guidance

Consult your operating system vendor (Red Hat, Debian, Ubuntu, etc.) and the libarchive project's official security announcements for patched version identifiers. Typically, vendors release patched versions within weeks of public disclosure. Test patches in a non-production environment before deployment to ensure compatibility with dependent applications. Monitor the vendor advisory channels for backported fixes to older stable releases if your infrastructure requires them.

Detection guidance

Monitor file system access for suspicious tar file creation or extraction in directories accessed by libarchive processes. Log all calls to archive-related functions in applications using libarchive. Implement network detection rules to flag unexpected archive transfers to sensitive systems. Consider using file integrity monitoring (FIM) on critical archive processing directories. Host-based intrusion detection systems (HIDS) can alert on process crashes or segmentation faults that may indicate exploitation attempts, though these signals require context to confirm malicious intent.

Why prioritize this

Despite the moderate potential impact (DoS or RCE), this vulnerability receives a lower priority due to its constrained attack surface: local-only access requirement, user interaction needed, and low CVSS score. Organizations should prioritize patching only if they run libarchive on systems handling untrusted archive files from external sources or if libarchive is exposed via automated processing pipelines. If your environment strictly controls who can supply tar files and processes them in isolated contexts, risk is proportionally lower.

Risk score, explained

The CVSS 3.1 score of 3.9 (LOW) reflects the combination of local-only attack vector, low attack complexity, requirement for low privileges and user interaction, and limited scope of impact (confidentiality and availability only, no integrity impact). The heap overflow itself is serious, but the multiple preconditions—local access, user action, and the need to craft a specific malformed PAX header—reduce the overall risk profile compared to remotely exploitable memory corruption flaws.

Frequently asked questions