CVE-2026-5745: Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive
Published Apr 7, 2026
·Updated
A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archiveaclfromtextnl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).
Affected Software
10 affected componentsFixes available
Libarchive libarchive
Libarchive libarchive
redhat Hardened Images
redhat OpenShift Container Platform=4.0
redhat Enterprise Linux=6.0
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
redhat Enterprise Linux=9.0
redhat Enterprise Linux=10.0
debian/libarchive<=3.4.3-2+deb11u1, <=3.4.3-2+deb11u4, <=3.6.2-1+deb12u4, <=3.6.2-1+deb12u2, <=3.7.4-4+deb13u1
3.8.8-2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libarchiveto a version that resolves this vulnerability.Fixed in 3.8.8-2
Event History
Apr 7, 2026
Data Sourced
via Red Hat·02:41 PM
DescriptionSeverityAffected Software
CVE Published
via MITRE·02:57 PM
Data Sourced
via MITRE·02:57 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeaknessAffected Software
Jul 21, 2026
Data Sourced
via Ubuntu·08:15 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·08:17 PM
DescriptionAffected Software
Data Sourced
via Launchpad·08:17 PM
Description