by Kastro CVE-2026-5121
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support — Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing
Description · from the CVE record
A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.
Affected
ProductAffectedFixed inSource
Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory0:3.1.2-14.el7_9.2CNA
Red Hat Enterprise Linux 8see advisory0:3.3.3-7.el8_10CNA
Red Hat Enterprise Linux 8.2 Advanced Update Supportsee advisory0:3.3.2-8.el8_2.2CNA
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory0:3.3.3-1.el8_4.2CNA
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory0:3.3.3-1.el8_4.2CNA
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory0:3.3.3-6.el8_6.1CNA
Red Hat Enterprise Linux 8.6 Telecommunications Update Servicesee advisory0:3.3.3-6.el8_6.1CNA
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionssee advisory0:3.3.3-6.el8_6.1CNA
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory0:3.3.3-5.el8_8.2CNA
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionssee advisory0:3.3.3-5.el8_8.2CNA
Red Hat Enterprise Linux 9see advisory0:3.5.3-9.el9_7CNA
Red Hat Enterprise Linux 9see advisory0:3.5.3-9.el9_7CNA
Scores by source
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total