CVE-2026-5745

What it actually does

This vulnerability is a NULL pointer dereference in libarchive's ACL text parsing path, specifically archive_acl_from_text_nl(). When libarchive processes a malformed ACL string such as a bare "d" or "default" tag without the expected following fields, the parser can advance internal pointers without sufficient validation and dereference NULL. The result is process termination in applications that call the affected libarchive API, including archive-handling tools such as bsdtar and software that imports, scans, extracts, indexes, or validates archives using libarchive. The impact is denial of service only; the provided details do not indicate code execution, privilege escalation, or data disclosure.

Why it matters to the business

An attacker who can get a user or automated workflow to process a specially crafted archive may be able to crash the archive-processing application or service. This can disrupt package ingestion, backup/restore jobs, CI/CD pipelines, container/image scanning, file-upload processing, malware analysis sandboxes, or administrative tooling that relies on libarchive. The CVSS availability impact is high, but exploitation requires local processing of a malicious archive and user or workflow interaction; EPSS is currently low and the issue is not listed in CISA KEV, so priority should be driven by exposure of automated archive-processing paths and criticality of affected services.

How an attack unfolds

An attacker crafts an archive containing malformed ACL metadata designed to reach libarchive's ACL parsing logic with an incomplete default ACL tag, for example a bare "d" or "default" value without required subsequent ACL fields. The attacker then delivers the archive through a path where it will be opened or extracted by a libarchive-linked application, such as a user running bsdtar, an upload-processing service, a security scanner, a build pipeline, or a container/image workflow. When the application parses the crafted ACL text, archive_acl_from_text_nl() fails to adequately validate the malformed input before pointer advancement, leading to a NULL pointer dereference. The affected process crashes, causing a denial of service for that user action, job, service worker, or automated pipeline.

How to fix it

Upgrade libarchive and affected vendor packages to versions containing the ACL parser fix as soon as they are available from the relevant operating system, container base image, or platform vendor. No exact fixed versions were provided in the input, so track Red Hat advisories and package errata for libarchive, Red Hat Enterprise Linux, Red Hat OpenShift Container Platform, and Red Hat hardened images. Rebuild and redeploy containers, appliances, and applications that statically link or bundle libarchive after the fixed library is available. As interim mitigation, restrict untrusted archive processing, avoid preserving/parsing ACLs from untrusted archives where operationally possible, isolate archive extraction in sandboxed workers with resource supervision and automatic restart, and require file-upload and pipeline systems to treat archive parser crashes as suspicious events rather than simply retrying indefinitely.

How to confirm the fix worked

Confirm the installed libarchive package version is at or above the vendor-fixed release once advisories are published. On Linux systems, inventory both OS packages and embedded copies by checking package managers, container image SBOMs, and application dependency manifests. Validate that bsdtar and other archive-processing tools are dynamically linked to the remediated libarchive library where applicable. In staging, process a benign regression archive that exercises ACL parsing and confirm normal behavior; if a vendor-provided reproducer or test case is available, verify the patched build rejects malformed ACL input without crashing. For containerized platforms, confirm all affected base images and derived images have been rebuilt from fixed images and redeployed.

Typical attack path

1. Create or obtain an archive containing malformed ACL metadata that triggers libarchive ACL parsing, such as an incomplete "d" or "default" ACL tag.
2. Deliver the crafted archive to a target through email, file upload, repository contribution, package submission, shared storage, container/image workflow, or another archive-ingestion path.
3. Wait for a user, scheduled job, scanner, CI/CD worker, backup process, or other automation to open, list, inspect, or extract the archive using software linked against vulnerable libarchive.
4. Trigger archive_acl_from_text_nl() during ACL parsing.
5. Cause a NULL pointer dereference and crash the archive-processing process, resulting in denial of service for the affected workflow or service.

How to detect it

To determine whether this vulnerability was already exploited, review logs and telemetry for crashes of libarchive-linked applications immediately after processing archives from untrusted sources. Useful sources include systemd journal, syslog, kernel logs, application logs for upload/extraction/scanning services, CI/CD job logs, container runtime logs, Kubernetes pod restart events, core dump metadata, EDR process-crash telemetry, and web or API access logs showing archive uploads shortly before crashes. Look for segmentation faults, NULL pointer dereference messages, abnormal exits, repeated worker restarts, or core dumps involving bsdtar, tar-like utilities, archive scanners, package ingestion workers, image scanning components, or custom services linked to libarchive. Correlate crash timestamps with recently received archive files and preserve the triggering archive, process core, command-line arguments, and library versions for forensic analysis. No public exploitation, KEV listing, ransomware use, or named threat actor activity was provided, so detection should focus on behavioral evidence of induced parser crashes rather than known campaign indicators.

• archive_acl_from_text_nl
• bsdtar
• libarchive
• Segmentation fault
• segfault
• core dumped
• NULL pointer dereference
• Process terminated with signal 11
• signal 11
• SIGSEGV
• default
• d

What your security team should do

• Prioritize remediation for internet-facing or multi-tenant services that automatically inspect, upload, extract, scan, or transform untrusted archives using libarchive.
• Inventory affected libarchive usage across servers, containers, CI/CD runners, image scanners, package ingestion services, backup tooling, and endpoint utilities such as bsdtar.
• Subscribe to and apply vendor errata for libarchive, Red Hat Enterprise Linux, Red Hat OpenShift Container Platform, and Red Hat hardened images; rebuild dependent images after patched packages are released.
• Until patched, isolate archive processing in least-privileged sandboxes with worker restart limits, crash monitoring, and queue back-pressure to prevent repeated denial-of-service loops.
• Add monitoring for repeated crashes or segmentation faults in archive-processing processes shortly after handling user-supplied archives.
• Treat unsolicited or newly uploaded archives that repeatedly crash scanners or extraction tools as suspicious and preserve samples for analysis.
• Because EPSS is low, exploit maturity is reported as none, and the vulnerability is not in KEV, schedule broad patching according to normal availability-risk SLAs while accelerating fixes for high-volume automated archive-processing services.