CVE-2026-5121: Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

— Microsoft

On 32-bit systems, an integer overflow in the zisofs block pointer allocation logic (archivereadsupportformatiso9660.c, line 1537) wraps the allocation size to zero. malloc(0) returns a ~16-byte buffer, but the code records the un-wrapped size (~4 GB) and proceeds to memcpy() attacker-controlled ISO data into the tiny buffer - a heap buffer overflow WRITE. On 64-bit systems the overflow doesn't wrap and malloc fails safely. Shares root cause with vulnerability #2 (unvalidated pzlog2bs).Requirements to exploit: The target must be a 32-bit system processing a crafted ISO9660 image via libarchive. The attacker needs to deliver the ISO to an application that extracts or reads its contents. Exploitation to RCE would require heap grooming specific to the target allocator/platform.

— Red Hat