CVE-2026-4426 Libarchive: libarchive: denial of service via malformed iso file processing
A remote attacker can cause a denial of service by supplying a specially crafted ISO file to applications using the Libarchive library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-4426?
CVE-2026-4426 is a medium-severity denial of service vulnerability in Libarchive Libarchive, published on 19 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.
Weakness: CWE-1335
Which versions are affected by CVE-2026-4426?
It affects 4 products.
Products include Libarchive Libarchive, Redhat Enterprise Linux, Redhat Hardened Images, Redhat Openshift Container Platform.
How do I fix CVE-2026-4426?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-4426 being exploited?
There is no known exploitation of CVE-2026-4426 in the wild and no public exploit code.
Other vulnerabilities in Libarchive Libarchive
Sources
Also known as AZL-80400, BELL-CVE-2026-4426, DEBIAN-CVE-2026-4426, ECHO-f87d-ff1f-0ccd, GHSA-r3fp-vrpw-pg77, MINI-8q29-rppm-cjp8 and 1 more.