CVE-2026-14164: libarchive RAR5 DoS Vulnerability

CVE-2026-14164 Overview

CVE-2026-14164 is a double-free vulnerability [CWE-415] in the RAR5 reader component of libarchive, a widely used library for reading and writing archive formats. The flaw resides in how the RAR5 reader manages the filtered_buf pointer during unpacking state reinitialization. When parsing a crafted RAR5 archive, the pointer can remain stale after being freed, and subsequent processing of another archive entry triggers a second free of the same memory region.

Applications that link against the vulnerable libarchive API can terminate unexpectedly when processing malicious input, resulting in denial of service. The issue affects any consumer of libarchive that processes untrusted RAR5 content, including archive utilities, package managers, and file scanners.

Critical Impact
Remote attackers can crash any application linked to a vulnerable libarchive build by delivering a specially crafted RAR5 archive, causing denial of service without requiring authentication or user interaction beyond opening the file.

Affected Products

libarchive RAR5 reader (versions prior to the fix in pull request #3071)
Red Hat Enterprise Linux distributions covered by RHSA-2026:30333
Downstream applications and utilities that link against vulnerable libarchive builds (for example, bsdtar, package managers, and file scanners)

Discovery Timeline

2026-06-30 - CVE-2026-14164 published to the National Vulnerability Database
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-14164

Vulnerability Analysis

The vulnerability affects the RAR5 decompression path in libarchive. During processing of a RAR5 archive, the reader allocates a working buffer referenced by the filtered_buf pointer to hold filtered output data. When the unpacking state is reinitialized between archive entries, the buffer is freed but the pointer is not cleared. This leaves a dangling reference inside the RAR5 state structure.

When the reader processes the next entry within the same archive, the cleanup or reinitialization logic reaches the stale pointer and calls free on it a second time. The double free corrupts heap metadata in most malloc implementations. On modern allocators such as glibc with tcache and safe-linking, the process typically aborts with a detected error, producing an immediate denial of service.

The attack surface is broad because libarchive is embedded in operating system utilities, security scanners, and language runtimes. Any workflow that automatically extracts archives from untrusted sources becomes an attack vector.

Root Cause

The root cause is a missing pointer nullification after free. The RAR5 unpacking state reinitialization frees filtered_buf without setting it to NULL, violating the invariant that freed pointers must not be reused. Later cleanup code assumes the pointer is either valid or NULL and calls free again, triggering [CWE-415] Double Free.

Attack Vector

Exploitation requires only that a vulnerable application parse an attacker-supplied RAR5 archive. The archive must contain multiple entries structured to trigger unpacking state reinitialization between them. Delivery paths include email attachments, web downloads, package repositories, and automated file processing pipelines. No privileges or user interaction beyond opening or scanning the file are required. The current impact is limited to availability, not confidentiality or integrity.

Refer to the GitHub Pull Request #3071 - Libarchive for the upstream fix and the GitHub Issue #3069 - Libarchive for reproducer details.

Detection Methods for CVE-2026-14164

Indicators of Compromise

Unexpected termination of processes that read archives, such as bsdtar, package managers, or antivirus scanners, with glibc messages like double free or corruption or free(): double free detected in tcache 2.
Core dumps or crash reports referencing the RAR5 reader path within libarchive, particularly frames involving filtered_buf handling.
Repeated crashes correlated with processing of RAR5 archives received from external sources.

Detection Strategies

Inventory systems and container images to identify installed libarchive versions and applications that statically link the library.
Monitor endpoint telemetry for abnormal termination of archive-handling utilities immediately after RAR5 file access.
Deploy YARA or file-format rules that flag RAR5 archives with anomalous multi-entry structures for offline analysis before extraction.

Monitoring Recommendations

Alert on segmentation faults and glibc heap corruption messages in system logs (/var/log/messages, journald) originating from archive processing services.
Track file-scanning services and mail gateways for repeated worker restarts triggered by inbound RAR5 attachments.
Correlate archive extraction events with process crashes in SIEM data to identify targeted denial-of-service attempts.

How to Mitigate CVE-2026-14164

Immediate Actions Required

Apply vendor-supplied libarchive updates on all affected systems, prioritizing servers that process untrusted archives such as mail gateways, file scanners, and build systems.
On Red Hat systems, install the packages provided in Red Hat Security Advisory RHSA-2026:30333.
Rebuild and redeploy any application that statically links libarchive against the patched version.

Patch Information

The upstream fix is available in GitHub Pull Request #3071 - Libarchive, which clears the filtered_buf pointer after freeing it to prevent the second free call. Distribution-specific patches are tracked in Red Hat CVE-2026-14164 Security Info and Red Hat Bug Report #2493411.

Workarounds

Disable RAR5 handling in applications that expose configuration to select supported archive formats.
Block or quarantine RAR5 archives at mail and web gateways until patched builds are deployed.
Sandbox archive extraction in isolated containers or restricted user contexts so a crash does not affect the parent service.

bash

# Verify installed libarchive version on Red Hat based systems
rpm -q libarchive

# Apply the security update
sudo dnf update libarchive

# Identify processes still using the pre-update library
sudo lsof | grep -i libarchive