CVE-2026-15028: Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header
A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.
Other sources
Hello Red Hat PSIRT,
I would like to request CVE assignment for a security vulnerability I found in libarchive.
There is a heap overflow problem while parsing a tar archive that contains a PAX extended header with the SUN.holesdata sparse-file attribute. headerpaxextension() passes the attribute value to paxattribute() with the trailing newline excluded from the value length. The SUN.holesdata parser later treats the byte after the supplied value as if it were still part of the accessible buffer and reads it when length == 0.
More detail can be found in github issue: https://github.com/libarchive/libarchive/issues/3251 A fixed PR has been commit: https://github.com/libarchive/libarchive/pull/3253
Until send this email, I have search no public report of this flaw. I want to know if it can be assgned a CVE ID or do you need any other more detail informations.
Best regards, Bon Voyage
— Red Hat
Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.7-7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15028?
The severity of CVE-2026-15028 is rated as low with a score of 3.9.
How do I fix CVE-2026-15028?
To mitigate CVE-2026-15028, it is recommended to update to the latest version of libarchive that addresses this vulnerability.
What kind of attack is possible with CVE-2026-15028?
CVE-2026-15028 allows a remote attacker to trigger a heap overflow by sending a specially crafted tar archive.
Which software is affected by CVE-2026-15028?
CVE-2026-15028 affects the Libarchive library used for handling archive files.
What is the impact of exploiting CVE-2026-15028?
Successful exploitation of CVE-2026-15028 could lead to a potential denial of service or arbitrary code execution.