AZL-91713

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91713.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-91713
Upstream
  • CVE-2026-14164
Published
2026-06-30T07:16:32Z
Modified
2026-09-20T05:33:47Z
Summary
CVE-2026-14164 affecting package libarchive for versions less than 3.7.7-7
Details

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

References

Affected packages

Azure Linux:3 / libarchive

Package

Name
libarchive
Purl
pkg:rpm/azure-linux/libarchive

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.7.7-7

Database specific

source 
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91713.json"