CVE-2026-15028: libarchive Heap Overflow RCE Vulnerability

CVE-2026-15028 Overview

A heap overflow vulnerability exists in libarchive, the widely used open-source library for reading and writing streaming archive formats. The flaw resides in the parser that handles PAX extended headers, specifically when processing a malformed SUN.holesdata sparse-file attribute inside a crafted tar archive. An attacker who can convince a user to open or process a malicious tar file triggers memory corruption on the heap [CWE-122]. Successful exploitation can cause the affected process to crash, resulting in denial of service, and may permit arbitrary code execution within the context of the process invoking libarchive. The issue is tracked under Red Hat advisory RHSA-2026:38279.

Critical Impact
Processing an untrusted tar archive with a malformed SUN.holesdata PAX attribute can corrupt heap memory in libarchive, leading to denial of service or arbitrary code execution.

Affected Products

libarchive (upstream project) — versions containing the vulnerable PAX SUN.holesdata parser
Red Hat Enterprise Linux packages referenced in RHSA-2026:38279
Downstream utilities linking libarchive, including bsdtar and archive-handling tooling

Discovery Timeline

2026-07-10 - CVE-2026-15028 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database
2026-07-20 - EPSS score published

Technical Details for CVE-2026-15028

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the tar reader component of libarchive. PAX extended headers extend the classic tar format with key-value attribute records, and the Sun-specific SUN.holesdata attribute describes sparse-file hole and data offsets. When libarchive parses a SUN.holesdata value that does not conform to the expected numeric offset-length pair layout, downstream logic writes past the bounds of a heap allocation associated with the sparse-file descriptor list. Because the attribute value is attacker-controlled inside the archive, adversaries influence both the size and content of the overflowing write. The condition is reachable from any code path that invokes libarchive to read a PAX-formatted tar, including command-line tools, backup agents, package managers, and applications embedding the library.

Root Cause

The root cause is missing validation of the parsed SUN.holesdata attribute against the buffer used to store sparse-region metadata. The parser trusts the count or offsets encoded in the header without verifying they match the actual allocation, producing an out-of-bounds heap write classified as [CWE-122]. Refer to the GitHub Issue #3251 Discussion and GitHub Pull Request #3253 Review for the upstream analysis and fix.

Attack Vector

Exploitation requires a local user to interact with a malicious archive using an application that links libarchive. The attacker delivers a crafted tar file containing a PAX extended header with a malformed SUN.holesdata record. When the victim extracts, lists, or otherwise parses the archive, the vulnerable code path corrupts heap memory. The impact is limited to the privileges of the invoking process, which aligns with the low confidentiality, integrity, and availability impact described in the advisory. See the Red Hat CVE-2026-15028 Details for the vendor assessment.

Detection Methods for CVE-2026-15028

Indicators of Compromise

Unexpected crashes, SIGSEGV, or glibc heap corruption messages from processes that invoke libarchive (for example bsdtar, backup agents, package tooling).
Tar archives containing PAX extended header records referencing SUN.holesdata with abnormally large counts or non-numeric fields.
Core dumps whose faulting frames include libarchive tar reader functions parsing sparse-file metadata.

Detection Strategies

Inspect ingested tar archives for PAX headers containing the SUN.holesdata keyword and validate the record structure before extraction.
Enable AddressSanitizer or heap hardening (MALLOC_CHECK_, glibc tcache checks) on services that parse untrusted archives to surface out-of-bounds writes.
Correlate process crashes of archive-handling utilities with recent file transfers or email attachments containing .tar, .tar.gz, or .tar.xz files.

Monitoring Recommendations

Audit endpoints and servers for the installed libarchive version and flag hosts running builds prior to the fix referenced in RHSA-2026:38279.
Monitor execution of archive utilities on user endpoints, especially when triggered by mail clients, browsers, or messaging apps.
Alert on repeated abnormal terminations of the same archive-handling binary across multiple hosts, which may indicate a distributed exploitation attempt.

How to Mitigate CVE-2026-15028

Immediate Actions Required

Apply the vendor-provided libarchive update from the Red Hat Security Advisory RHSA-2026:38279 or the equivalent patch from your distribution.
Restart or redeploy long-running services (backup agents, container runtimes, package managers) that link libarchive after patching to ensure the new library is loaded.
Block or quarantine untrusted tar archives at the mail and web gateways until affected hosts are updated.

Patch Information

The upstream fix is tracked in GitHub Pull Request #3253 Review and referenced in Red Hat Bugzilla Report #2497970. Red Hat Enterprise Linux users should install the packages shipped in RHSA-2026:38279. Other distributions and vendors that redistribute libarchive should backport the same upstream commit.

Workarounds

Avoid extracting or listing tar archives received from untrusted sources on unpatched systems.
Where feasible, process archives inside sandboxed or containerized environments with restricted privileges and seccomp filters.
Configure archive-handling services to reject PAX headers containing vendor-specific SUN.* attributes when they are not required by the workflow.

bash

# Verify installed libarchive version and apply the vendor update
rpm -q libarchive
sudo dnf update --advisory=RHSA-2026:38279 libarchive bsdtar

# Confirm the patched build is loaded by running processes
sudo lsof /usr/lib64/libarchive.so* | awk '{print $1,$2}' | sort -u