CVE-2026-4426: Libarchive: libarchive: denial of service via malformed iso file processing
A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (pzlog2bs) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.
Other sources
An Undefined Behavior vulnerability exists in the zisofs decompression logic of the libarchive library. The flaw is caused by improper validation of the pzlog2bs field, which is directly read from ISO9660 Rock Ridge extensions and used as a shift exponent in arithmetic operations. When a specially crafted ISO file provides an out-of-range value (e.g., ≥64 on 64-bit systems), it triggers undefined behavior due to invalid shift operations, leading to incorrect memory allocation and potential crashes. This vulnerability can be exploited by supplying a malicious ISO file, resulting in denial-of-service conditions in applications that process ISO images.
— Red Hat
Libarchive: libarchive: denial of service via malformed iso file processing
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libarchiveto a version that resolves this vulnerability.Fixed in 3.4.3-2+deb11u4Fixed in 3.6.2-1+deb12u4Fixed in 3.7.4-4+deb13u1Fixed in 3.8.7-1 - Configuration
Apply a fix that properly validates the pz_log2_bs field read from ISO9660 Rock Ridge extensions before using it as a shift exponent in zisofs decompression logic, preventing invalid shift operations and resulting incorrect memory allocation/crashes (DoS).
libarchive (zisofs decompression) pZ_log2_bs validation for ISO9660 Rock Ridge extensions = Reject out-of-range pz_log2_bs values (e.g., values ≥64 on 64-bit systems)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4426?
CVE-2026-4426 has been categorized as a denial of service vulnerability.
How do I fix CVE-2026-4426?
To fix CVE-2026-4426, you should update libarchive to the latest version that contains the security patch.
What types of systems are affected by CVE-2026-4426?
CVE-2026-4426 affects systems utilizing libarchive for processing ISO files, particularly those that handle Rock Ridge extensions.
What are the potential impacts of CVE-2026-4426?
The potential impacts of CVE-2026-4426 include application crashes and denial of service when processing malformed ISO files.
How does CVE-2026-4426 exploit the libarchive library?
CVE-2026-4426 exploits undefined behavior in zisofs decompression logic due to improper validation of specific fields.