CVE-2026-5121 Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

What is CVE-2026-5121?

CVE-2026-5121 is a high-severity vulnerability in Libarchive Libarchive, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

Weakness: CWE-190

Which versions are affected by CVE-2026-5121?

It affects 4 products.

Products include Libarchive Libarchive, Redhat Enterprise Linux, Redhat Hardened Images, Redhat Openshift Container Platform.

How do I fix CVE-2026-5121?

Apply the vendor's patch.

Is CVE-2026-5121 being exploited?

There is no known exploitation of CVE-2026-5121 in the wild and no public exploit code.

Other vulnerabilities in Libarchive Libarchive

• CVE-2024-37407 Memory corruption in n/a Critical 9.1
• CVE-2016-1541 Memory corruption in n/a High 8.8
• CVE-2016-6250 Integer overflow in n/a High 8.6
• CVE-2025-5914 Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c High 7.8
• CVE-2024-48957 Memory corruption in n/a High 7.8

All Libarchive Libarchive vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-81504, CLSA-2026-1777365744, CLSA-2026-1777366496, DEBIAN-CVE-2026-5121, ECHO-fe78-e324-d857, GHSA-2vwv-vqpv-v8vc and 2 more.