CVE-2026-17591: libarchive Use-After-Free Vulnerability

CVE-2026-17591 Overview

CVE-2026-17591 is a use-after-free vulnerability [CWE-416] in the libarchive library. The flaw resides in the archive_entry_copy_mac_metadata() function, which deallocates an internal buffer before completing a data copy operation. An attacker who supplies crafted input to an application that calls this function can trigger a crash or read uninitialized memory contents. The impact is limited to denial of service and partial information disclosure, both constrained to the local attack surface with high complexity and required user interaction.

Critical Impact
Applications linking libarchive and processing attacker-supplied archive input may crash or disclose uninitialized memory data from the host process.

Affected Products

libarchive (versions containing the vulnerable archive_entry_copy_mac_metadata() implementation)
Red Hat Enterprise Linux distributions shipping affected libarchive packages (see Red Hat Security Advisory RHSA-2026:77775)
Downstream applications that call archive_entry_copy_mac_metadata() on untrusted archive input

Discovery Timeline

2026-10-16 - CVE-2026-17591 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-17591

Vulnerability Analysis

The defect is a classic use-after-free condition in libarchive. During processing of macOS metadata entries, archive_entry_copy_mac_metadata() releases an internal buffer before the copy operation completes. Subsequent reads from the freed memory region produce undefined behavior.

Two primary outcomes exist. The process may crash when the freed region is reused or unmapped, producing a denial-of-service condition. Alternatively, the function may return uninitialized bytes left behind in the heap, exposing fragments of unrelated process memory to the calling application.

Exploitation requires local access, user interaction to supply or open crafted archive input, and succeeds only under specific heap conditions. See the GitHub Pull Request #3318 for the upstream fix.

Root Cause

The root cause is incorrect lifetime management of an internal metadata buffer inside archive_entry_copy_mac_metadata(). The function invokes free() on the buffer before the pending copy operation finishes referencing it. Any subsequent access dereferences a dangling pointer. This pattern is tracked under CWE-416: Use After Free.

Attack Vector

An attacker crafts an archive containing malformed macOS metadata and delivers it to a user running an application that links libarchive. When the application parses the entry and calls archive_entry_copy_mac_metadata(), the freed buffer is dereferenced. The attacker has no network reach and must induce the victim to open the file. Resulting primitives are a process crash or disclosure of uninitialized heap memory in the victim process context.

No verified public exploit code is available. Refer to the Red Hat Bug Report #2554209 for triage detail.

Detection Methods for CVE-2026-17591

Indicators of Compromise

Repeated crashes or SIGSEGV signals in processes that link libarchive when parsing archive files
Core dumps referencing archive_entry_copy_mac_metadata in the call stack
Archive files containing anomalous or oversized macOS metadata (AppleDouble, resource fork) entries

Detection Strategies

Enable AddressSanitizer (ASan) in test environments to catch use-after-free dereferences during archive parsing.
Inventory installed libarchive versions across endpoints and servers; compare against patched builds published in RHSA-2026:77775.
Monitor file-handling applications (package managers, backup tools, archivers) for abnormal termination during extraction tasks.

Monitoring Recommendations

Collect application crash telemetry and correlate with recent archive file access events.
Alert on repeated bsdtar, unzip, or installer process crashes triggered by the same input file.
Track package inventory changes to confirm libarchive updates are applied across the fleet.

How to Mitigate CVE-2026-17591

Immediate Actions Required

Apply vendor updates for libarchive as soon as they are available from your distribution.
Rebuild and redeploy statically linked applications that bundle a vulnerable libarchive copy.
Restrict processing of untrusted archive files, particularly those originating from external or unverified sources.

Patch Information

The upstream fix is tracked in GitHub Pull Request #3318. Red Hat has published fixed packages via RHSA-2026:77775. Consult the Red Hat CVE-2026-17591 advisory for the full list of affected and remediated package versions.

Workarounds

Avoid invoking code paths that call archive_entry_copy_mac_metadata() on untrusted input until patches are applied.
Run archive-processing utilities inside sandboxes or containers with minimal privileges and no sensitive memory neighbors.
Validate archive sources and reject files from untrusted origins at the perimeter or email gateway.

bash

# Verify installed libarchive version and apply distribution update
rpm -q libarchive
sudo dnf update libarchive