ZeroDay Findings
Sign inSign up

Findings

CVE-2026-4426

A flaw was found in libarchive.

Published Mar 19, 2026 · updated Sep 1, 2026 · libarchive libarchive

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field ( ) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 19, 2026 · NIST NVD

    Detected

    A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field ( ) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) conditi

  2. Sep 1, 2026 · NIST NVD

    Updated

    A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field ( ) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) conditi

Affected

  • cpe libarchive/libarchiveversion unspecified
  • cpe redhat/enterprise linux10.0
  • cpe redhat/enterprise linux6.0
  • cpe redhat/enterprise linux7.0
  • cpe redhat/enterprise linux8.0
  • cpe redhat/enterprise linux9.0
  • cpe redhat/hardened imagesversion unspecified
  • cpe redhat/openshift container platform4.0

Sources

  • CVE.orgVulnerability recordCVE-2026-4426

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-4426

    A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field ( ) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO f

    nvd.nist.gov

References