CVE-2026-17591— Libarchive: libarchive: use-after-free via aliased mac metadata copy
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 libarchive 中发现一个漏洞：由于存在释放后使用（use-after-free）问题，攻击者可引发拒绝服务（DoS）或潜在的信息泄露。该漏洞表现为程序读取了已被释放的内存。具体而言，当 archive_entry_copy_mac_metadata() 函数在完成数据拷贝之前就释放了内部缓冲区时，就会触发此问题。若攻击者能够向使用该函数的应用程序提供输入，即可利用该漏洞导致应用程序崩溃，或读取未初始化的内存数据。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-17591
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Libarchive: libarchive: use-after-free via aliased mac metadata copy
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
II. Public POCs for CVE-2026-17591
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-17591
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-17591 (1)
Vendor Advisories for CVE-2026-17591 (2)
-
-
🔗 2554209 – (CVE-2026-17591) CVE-2026-17591 libarchive: libarchive: use-after-free via aliased Mac metadata copy Read full article issue-tracking x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-10-16 · 15 CVEs total
| CVE-2026-104715 | 7.8 HIGH | Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary by |
| CVE-2026-105958 | 7.5 HIGH | Spice-server: spice: heap oob read/write via unchecked migration data offsets |
| CVE-2026-105959 | 7.5 HIGH | Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncati |
| CVE-2026-62439 | 7.0 HIGH | Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow |
| CVE-2026-89085 | 6.6 MEDIUM | Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image |
| CVE-2026-111802 | 6.6 MEDIUM | Nautilus: nautilus: arbitrary file deletion via trash symlink |
| CVE-2026-85231 | 6.5 MEDIUM | Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss de |
| CVE-2026-62438 | 6.1 MEDIUM | Gimp: gimp: paa integer overflow out-of-bounds read |
| CVE-2026-111555 | 6.0 MEDIUM | Luksmeta: missing slot-range validation permits out-of-gap device i/o |
| CVE-2026-89096 | 5.9 MEDIUM | Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd |
| CVE-2026-89088 | 5.5 MEDIUM | Parted: parted: denial of service via heap buffer overflow during fat16 resize |
| CVE-2026-89098 | 5.5 MEDIUM | Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd |
| CVE-2026-85977 | 5.3 MEDIUM | Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper re |
| CVE-2026-111581 | 3.3 LOW | Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-62438
Gimp: gimp: paa integer overflow out-of-bounds read
Same vendor: Red Hat
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-62438
Gimp: gimp: paa integer overflow out-of-bounds read
Same weakness: CWE-416
-
CVE-2026-110753
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a -
CVE-2026-85748
MariaDB: Use-after-free with a large number of SYS_REFCURSOR -
CVE-2026-110915
Chrome低于155.0.8059.84存在Use After Free漏洞 -
CVE-2026-110921
Chrome <155.0.8059.84 V8 UAF远程代码执行漏洞 -
CVE-2026-110919
Chrome<155.0.8059.84 V8使用释放后漏洞
V. Comments for CVE-2026-17591
No comments yet