CVE-2026-14164: Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()
A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filteredbuf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
Other sources
A double-free vulnerability exists in the libarchive RAR5 reader subsystem within archivereadsupportformatrar5.c where the state tracking pointer rar->cstate.filteredbuf can be linked to a temporary filter output block during archive decompression. When the unpacking engine subsequently processes an adjacent file or resets its internal state layout via initunpack(), it releases the allocation mapped to filteredbuf but fails to clear or nullify the underlying pointer variable. A specially crafted RAR5 archive can exploit this lingering dangling pointer by forcing a secondary release operation on the exact same memory address, triggering a standard memory-manager abort that immediately crashes the application and results in a Denial of Service (DoS).
— Red Hat
Libarchive: double-free vulnerability in rar5 decompression logic via dangling filteredbuf pointer in initunpack()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.7-7 - Upgrade
Upgrade
debian/libarchiveto a version that resolves this vulnerability.Fixed in 3.8.8-2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14164?
CVE-2026-14164 has a high severity rating of 7.5.
How do I fix CVE-2026-14164?
To fix CVE-2026-14164, update libarchive to the latest version that addresses this double-free vulnerability.
What type of vulnerability is CVE-2026-14164?
CVE-2026-14164 is classified as a double free vulnerability in the RAR5 decompression logic.
What are the potential impacts of CVE-2026-14164?
CVE-2026-14164 can result in a denial of service due to improper memory handling.
In which software is CVE-2026-14164 found?
CVE-2026-14164 is found in the libarchive software.