Log in Start free

Vulnerability · Published Jul 10, 2026 · Assigned by redhat

CVE-2026-15028Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header

Low 3.9

In plain English

A low-severity heap buffer overflow in Red Hat Cost Management On-Premise 1 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.9Low
Exploit odds (30 days)0.2%top 89.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10bsdtar3.7.7-11.el10_2ALSA-2026:69553
AlmaLinux:10libarchive3.7.7-11.el10_2ALSA-2026:69553
AlmaLinux:10libarchive-devel3.7.7-11.el10_2ALSA-2026:69553
Debian:12libarchive3.6.2-1+deb12u5DEBIAN-CVE-2026-15028
Debian:13libarchiveno fix listedDEBIAN-CVE-2026-15028
Debian:14libarchive3.8.9-1DEBIAN-CVE-2026-15028
Rocky Linux:10libarchive0:3.7.7-11.el10_2RLSA-2026:69553
Ubuntu:26.04:LTSlibarchive3.8.5-1ubuntu2.2UBUNTU-CVE-2026-15028

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Cost Management On-Premise 1 see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 5 see references

Weakness: CWE-805, CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

References