A critical security update addresses two vulnerabilities in libarchive (CVE-2026-4111 and CVE-2026-4424, both CVSS 7.5 HIGH), which allow for a denial of service via an infinite loop during RAR5 decompression and information disclosure via a heap out-of-bounds read during RAR archive processing. The update is rated Important and applies to Red Hat Enterprise Linux 10.0 Extended Update Support. Organizations should apply the vendor-provided patch for libarchive version 3.7.7-5.el10_0 to remediate these issues.
Red Hat Product Errata RHSA-2026:8865 - Security Advisory Issued: 2026-04-20 Updated: 2026-04-20 RHSA-2026:8865 - Security Advisory Overview Updated Packages Synopsis Important: libarchive security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for libarchive is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive (CVE-2026-4111) libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2446453 - CVE-2026-4111 libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive BZ - 2449006 - CVE-2026-4424 libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing CVEs CVE-2026-4111 CVE-2026-4424 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM libarchive-3.7.7-5.el10_0.src.rpm SHA-256: 1e1b58cd21366d9e43c5cc25a922023fe01625e461646b84d6336a28ba9ec6c8 x86_64 bsdcat-debuginfo-3.7.7-5.el10_0.x86_64.rpm SHA-256: 36622d78dc9490de60d2333968d5f88ecc9f55cebb26255bc3878f0d3fb43cb1 bsdcat-debuginfo-3.7.7-5.el10_0.x86_64.rpm SHA-256: 36622d78dc9490de60d2333968d5f88ecc9f55cebb26255bc3878f0d3fb43cb1 bsdcpio-debuginfo-3.7.7-5.el10_0.x86_64.rpm SHA-256: 82098db8928c17176967a0606c899c5ae537447f86243d8df0224a943a9cd98d bsdcpio-debuginfo-3.7.7-5.el10_0.x86_64.rpm SHA-256: 82098db8928c17176967a0606c899c5ae537447f86243d8df0224a943a9cd98d bsdtar-3.7.7-5.el10_0.x86_64.rpm SHA-256: 0ec21067e89784c4672486f4e31044150c38c731c21b4c79cadff0e46bfeaa60 bsdtar-debuginfo-3.7.7-5.el10_0.x86_64.rpm SHA-256: a83402e6454cbd645b6074d135194541bc28ed9c5cd1e57982760aa15cfa295c bsdtar-debuginfo-3.7.7-5.el10_0.x86_64.rpm SHA-256: a83402e6454cbd645b6074d135194541bc28ed9c5cd1e57982760aa15cfa295c bsdunzip-debuginfo-3.7.7-5.el10_0.x86_64.rpm SHA-256: bcdfc2b13bd7096f714b84c22da63296b7d3792aba44594ae9b937bf78069bee bsdunzip-debuginfo-3.7.7-5.el10_0.x86_64.rpm SHA-256: bcdfc2b13bd7096f714b84c22da63296b7d3792aba44594ae9b937bf78069bee libarchive-3.7.7-5.el10_0.x86_64.rpm SHA-256: 548a30ed1e153c20ee96bbfa3b9ec5b5139ff7cef91a4a6e16a6040d15857c7f libarchive-debuginfo-3.7.7-5.el10_0.x86_64.rpm SHA-256: f92226caff7ac872ce1cc3e02367a864378e2989a7c886e4a68f774e212a6e97 libarchive-debuginfo-3.7.7-5.el10_0.x86_64.rpm SHA-256: f92226caff7ac872ce1cc3e02367a864378e2989a7c886e4a68f774e212a6e97 libarchive-debugsource-3.7.7-5.el10_0.x86_64.rpm SHA-256: f9aa2bc38056859bc369f0d2a2d2b51903749c1ef0e5f6b40ea8119599e18533 libarchive-debugsource-3.7.7-5.el10_0.x86_64.rpm SHA-256: f9aa2bc38056859bc369f0d2a2d2b51903749c1ef0e5f6b40ea8119599e18533 libarchive-devel-3.7.7-5.el10_0.x86_64.rpm SHA-256: a1694fcc6fc27b7bbc4e1f7cddc1bb913315308b17329bfca75561af379ad15d Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 SRPM libarchive-3.7.7-5.el10_0.src.rpm SHA-256: 1e1b58cd21366d9e43c5cc25a922023fe01625e461646b84d6336a28ba9ec6c8 s390x bsdcat-debuginfo-3.7.7-5.el10_0.s390x.rpm SHA-256: eccb820413dbc5f4f979a05a371de7306d8f55047b136e618da9187ee6a8e943 bsdcat-debuginfo-3.7.7-5.el10_0.s390x.rpm SHA-256: eccb820413dbc5f4f979a05a371de7306d8f55047b136e618da9187ee6a8e943 bsdcpio-debuginfo-3.7.7-5.el10_0.s390x.rpm SHA-256: ba33fac4b44542e3c836cd832ef6205e64fc445b8b6d9d5bd8908657e745dc21 bsdcpio-debuginfo-3.7.7-5.el10_0.s390x.rpm SHA-256: ba33fac4b44542e3c836cd832ef6205e64fc445b8b6d9d5bd8908657e745dc21 bsdtar-3.7.7-5.el10_0.s390x.rpm SHA-256: 3701a11cd4805c99abf33dfdc5372ced969bbfe237abeed411415d526632814c bsdtar-debuginfo-3.7.7-5.el10_0.s390x.rpm SHA-256: 798c1ff66fcd9a91b6f93dfa112eec44eec83d644fd3c2e834eaef029f19ce6f bsdtar-debuginfo-3.7.7-5.el10_0.s390x.rpm SHA-256: 798c1ff66fcd9a91b6f93dfa112eec44eec83d644fd3c2e834eaef029f19ce6f bsdunzip-debuginfo-3.7.7-5.el10_0.s390x.rpm SHA-256: 79ac6361b1082ed5e3cd790c6499543809a46404159b298af2d6a7fc983f1278 bsdunzip-debuginfo-3.7.7-5.el10_0.s390x.rpm SHA-256: 79ac6361b1082ed5e3cd790c6499543809a46404159b298af2d6a7fc983f1278 libarchive-3.7.7-5.el10_0.s390x.rpm SHA-256: 8300bcaea5ea2ed9168d1ff87bd6dd5a784c5c927f00235c11fd34e0b4a34f27 libarchive-debuginfo-3.7.7-5.el10_0.s390x.rpm SHA-256: fcb10a18fcf5a6efca6b71ff42fa1ef5ea6c83e43640ab68aca00632688037cd libarchive-debuginfo-3.7.7-5.el10_0.s390x.rpm SHA-256: fcb10a18fcf5a6efca6b71ff42fa1ef5ea6c83e43640ab68aca00632688037cd libarchive-debugsource-3.7.7-5.el10_0.s390x.rpm SHA-256: 8759d819437882d54b02da22d1679c0953e64abecb16657723c8319d1dae131f libarchive-debugsource-3.7.7-5.el10_0.s390x.rpm SHA-256: 8759d819437882d54b02da22d1679c0953e64abecb16657723c8319d1dae131f libarchive-devel-3.7.7-5.el10_0.s390x.rpm SHA-256: 3ef70ebfac2cfb66bbf7690be5f0b82a02a9baed4949ea859c34aa51a26cf340 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 SRPM libarchive-3.7.7-5.el10_0.src.rpm SHA-256: 1e1b58cd21366d9e43c5cc25a922023fe01625e461646b84d6336a28ba9ec6c8 ppc64le bsdcat-debuginfo-3.7.7-5.el10_0.ppc64le.rpm SHA-256: eb22b14fe82ac85725949e0ec91a1ca38f494f4f9f0aea59a276a704c05803f3 bsdcat-debuginfo-3.7.7-5.el10_0.ppc64le.rpm SHA-256: eb22b14fe82ac85725949e0ec91a1ca38f494f4f9f0aea59a276a704c05803f3 bsdcpio-debuginfo-3.7.7-5.el10_0.ppc64le.rpm SHA-256: 5e62c6b212b95e4614b21585fa674b6f55b79bb7af82382f2ce36ea84578c972 bsdcpio-debuginfo-3.7.7-5.el10_0.ppc64le.rpm SHA-256: 5e62c6b212b95e4614b21585fa674b6f55b79bb7af82382f2ce36ea84578c972 bsdtar-3.7.7-5.el10_0.ppc64le.rpm SHA-256: 66a3d6f4c081722450e6e25ef268c94a9e6b39b0a886eff4b73545c9497c98fe bsdtar-debuginfo-3.7.7-5.el10_0.ppc64le.rpm SHA-256: 28015f0ae5489dc2f5d338b2101a3f6db831d9e55242330219947a2b186485be bsdtar-debuginfo-3.7.7-5.el10_0.ppc64le.rpm SHA-256: 28015f0ae5489dc2f5d338b2101a3f6db831d9e55242330219947a2b186485be bsdunzip-debuginfo-3.7.7-5.el10_0.ppc64le.rpm SHA-256: cbddeb9d4883017690e79a51f88e8d4da23ed2e76e617002436003a975acc373 bsdunzip-debuginfo-3.7.7-5.el10_0.ppc64le.rpm SHA-256: cbddeb9d4883017690e79a51f88e8d4da23ed2e76e617002436003a975acc373 libarchive-3.7.7-5.el10_0.ppc64le.rpm SHA-256: 3a8495e76fbf351a0724c45acf1c73edc9931c04dc16ed300ad58b6e25d12cef libarchive-debuginfo-3.7.7-5.el10_0.ppc64le.rpm SHA-256: 30c696a5225360811966b8bcdb948f05639b6826733602ad8d443cea9cbab077 libarchive-debuginfo-3.7.7-5.el10_0.ppc64le.rpm SHA-256: 30c696a5225360811966b8bcdb948f05639b6826733602ad8d443cea9cbab077 libarchive-debugsource-3.7.7-5.el10_0.ppc64le.rpm SHA-256: e647cbf061108a148689f6473d347f6258f0b409c7fa790f559f982c87aa3356 libarchive-debugsource-3.7.7-5.el10_0.ppc64le.rpm SHA-256: e647cbf061108a148689f6473d347f6258f0b409c7fa790f559f982c87aa3356 libarchive-devel-3.7.7-5.el10_0.ppc64le.rpm SHA-256: acbeea1becd59c17e9153dd99e0d2c14a492afc3e689624c2b2fd6ee9db126e6 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 SRPM libarchive-3.7.7-5.el10_0.src.rpm SHA-256: 1e1b58cd21366d9e43c5cc25a922023fe01625e461646b84d6336a28ba9ec6c8 aarch64 bsdcat-debuginfo-3.7.7-5.el10_0.aarch64.rpm SHA-256: d850241dd02fef75aaf83c1adf661bbaa8aec2d0fb87899606df2c31231eb937 bsdcat-debuginfo-3.7.7-5.el10_0.aarch64.rpm SHA-256: d850241dd02fef75aaf83c1adf661bbaa8aec2d0fb87899606df2c31231eb937 bsdcpio-debuginfo-3.7.7-5.el10_0.aarch64.rpm SHA-256: cb94e21e95498aa2d4bea6d8d11bf2e5bec828b28738dbce5f2ae46489bcdc1b bsdcpio-debuginfo-3.7.7-5.el10_0.aarch64.rpm SHA-256: cb94e21e95498aa2d4bea6d8d11bf2e5bec828b28738dbce5f2ae46489bcdc1b bsdtar-3.7.7-5.el10_0.aarch64.rpm SHA-256: 0562ed7625a5ea4e20109f2cbe2e7575f49b8cba392d3583397aa86bff2d0d65 bsdtar-debuginfo-3.7.7-5.el10_0.aarch64.rpm SHA-256: 7d2c5a9329899478409ff404001867b846d2179c27d980b39c373c21c5f67fbf bsdtar-debuginfo-3.7.7-5.el10_0.aarch64.rpm SHA-256: 7d2c5a9329899478409ff404001867b846d2179c27d980b39c373c21c5f67fbf bsdunzip-debuginfo-3.7.7-5.el10_0.aarch64.rpm SHA-256: 54849b5b4e507cb983a01bcbecb9407e736d09f0ba6ca5036af19860c1f7f9aa bsdunzip-debuginfo-3.7.7-5.el10_0.aarch64.rpm SHA-256: 54849b5b4e507cb983a01bcbecb9407e736d09f0ba6ca5036af19860c1f7f9aa libarchive-3.7.7-5.el10_0.aarch64.rpm SHA-256: b28bf9cd31b3713c507aefe8c9eeb71c6b83cbd964878e95b43e8e6354c6