Low [CVE-2026-15028] heap overflow OOB read while parsing a tar archive contains a PAX extended header

A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive.

The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.

Conditions for Exploitation: Successful exploitation requires user interaction or a specific application workflow.

Impact Limitations: Although the heap overflow has the potential to allow for arbitrary code execution, achieving this reliably is typically complex and highly dependent on the memory layout and protections of the specific application utilizing the library.

In most common scenarios, the malformed archive will simply cause the parsing application to crash, resulting in a localized Denial of Service (DoS) rather than a full system compromise. Red Hat severity: Moderate — CVSS 3.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L).

Weakness: CWE-805. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Cost Management On-Premise 1; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4.