RHSA-2026:58574: Moderate: libarchive security update

Q: Which systems are most likely to be exposed?

Systems that use libarchive to process archives are relevant, including deployments of bsdtar and applications using libarchive bindings such as python-libarchive. Popular desktop file managers may also use libarchive.

Q: What archive handling is associated with the flaw?

The issue is in RAR5 decompression logic, so exposure is associated with processing RAR5 archives through affected libarchive functionality.

Q: Which installed packages should be checked during triage?

Check for redhat/libarchive and redhat/bsdtar. The advisory also lists bsdcat-debuginfo, bsdcpio-debuginfo, bsdtar-debuginfo, libarchive-debuginfo, and libarchive-debugsource.

Published Aug 24, 2026

Updated

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.Security Fix(es): libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filteredbuf pointer in initunpack() (CVE-2026-14164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

28 affected componentsFixes available

redhat/libarchive<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/bsdcat-debuginfo<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/bsdcat-debuginfo<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/bsdcpio-debuginfo<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/bsdcpio-debuginfo<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/bsdtar<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/bsdtar-debuginfo<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/bsdtar-debuginfo<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/libarchive<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/libarchive-debuginfo<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/libarchive-debuginfo<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/libarchive-debugsource<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/libarchive-debugsource<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/bsdcat-debuginfo<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/bsdcpio-debuginfo<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/bsdtar<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/bsdtar-debuginfo<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/libarchive<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/libarchive-debuginfo<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/libarchive-debugsource<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

redhat/bsdcat-debuginfo<3.5.3-5.el9_2.3.aa

3.5.3-5.el9_2.3.aa

redhat/bsdcpio-debuginfo<3.5.3-5.el9_2.3.aa

3.5.3-5.el9_2.3.aa

redhat/bsdtar<3.5.3-5.el9_2.3.aa

3.5.3-5.el9_2.3.aa

redhat/bsdtar-debuginfo<3.5.3-5.el9_2.3.aa

3.5.3-5.el9_2.3.aa

redhat/libarchive<3.5.3-5.el9_2.3.aa

3.5.3-5.el9_2.3.aa

redhat/libarchive-debuginfo<3.5.3-5.el9_2.3.aa

3.5.3-5.el9_2.3.aa

redhat/libarchive-debugsource<3.5.3-5.el9_2.3.aa

3.5.3-5.el9_2.3.aa

redhat/bsdtar<3.5.3-5.el9_2.3

3.5.3-5.el9_2.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/libarchive to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3
Upgrade
Upgrade redhat/bsdcat-debuginfo to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3
Upgrade
Upgrade redhat/bsdcpio-debuginfo to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3
Upgrade
Upgrade redhat/bsdtar to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3
Upgrade
Upgrade redhat/bsdtar-debuginfo to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3
Upgrade
Upgrade redhat/libarchive-debuginfo to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3
Upgrade
Upgrade redhat/libarchive-debugsource to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3
Upgrade
Upgrade redhat/bsdcat-debuginfo to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3.aa
Upgrade
Upgrade redhat/bsdcpio-debuginfo to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3.aa
Upgrade
Upgrade redhat/bsdtar to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3.aa
Upgrade
Upgrade redhat/bsdtar-debuginfo to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3.aa
Upgrade
Upgrade redhat/libarchive to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3.aa
Upgrade
Upgrade redhat/libarchive-debuginfo to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3.aa
Upgrade
Upgrade redhat/libarchive-debugsource to a version that resolves this vulnerability.
Fixed in 3.5.3-5.el9_2.3.aa
Upgrade
Upgrade libarchive to a version that resolves this vulnerability.
Patch CVE-2026-14164

Event History

Aug 24, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

Which systems are most likely to be exposed?

Systems that use libarchive to process archives are relevant, including deployments of bsdtar and applications using libarchive bindings such as python-libarchive. Popular desktop file managers may also use libarchive.

What archive handling is associated with the flaw?

The issue is in RAR5 decompression logic, so exposure is associated with processing RAR5 archives through affected libarchive functionality.

Which installed packages should be checked during triage?

Check for redhat/libarchive and redhat/bsdtar. The advisory also lists bsdcat-debuginfo, bsdcpio-debuginfo, bsdtar-debuginfo, libarchive-debuginfo, and libarchive-debugsource.

RHSA-2026:58574: Moderate: libarchive security update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are most likely to be exposed?

What archive handling is associated with the flaw?

Which installed packages should be checked during triage?

Company

Resources

Contact

Frequently Asked Questions

Which systems are most likely to be exposed?

What archive handling is associated with the flaw?

Which installed packages should be checked during triage?