CVE-2026-5745 Red Hat CVE debrief

Who should care

Users of libarchive, bsdtar, and other applications that utilize the libarchive API should be aware of this vulnerability and take steps to mitigate it. Additionally, system administrators and security teams should monitor for potential Denial of Service (DoS) attacks.

Technical summary

The archive_acl_from_text_nl() function in libarchive fails to perform adequate validation before advancing the pointer when processing a malformed ACL string, leading to a NULL pointer dereference vulnerability. This can cause an application utilizing the libarchive API, such as bsdtar, to crash, resulting in a Denial of Service (DoS). The vulnerability is triggered by a malformed ACL string, such as a bare 'd' or 'default' tag without subsequent fields. Affected products include libarchive and applications that utilize the libarchive API. Users should implement compensating controls and monitor for potential Denial of Service (DoS) attacks. The vulnerability has a CVSS score of 5.5 and a medium severity impact. The official CVE record and NVD detail provide additional information about the vulnerability. Users should review the official advisory for affected scope, severity, and vendor guidance. The affected product deployments should be identified, and owners should be assigned for follow-up. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested, and the item should be closed only after evidence is documented. The CVE record was published on 2026-04-07T16:16:32.307Z and has not been modified since then. The NVD entry is currently Modified. Red Hat errata page for RHSA-2026:8944 provides information about the vulnerability and potential mitigations. Red Hat security page for CVE-2026-5745 provides additional information about the vulnerability. Bugzilla page for issue 2455921 provides detailed information about the vulnerability and potential fixes. The archive_acl_from_text_nl() function fails to perform adequate validation before advancing the pointer when processing a malformed ACL string, leading to a NULL pointer dereference vulnerability. This can cause an application utilizing the libarchive API, such as bsdtar, to crash, resulting in a Denial of Service (DoS). The vulnerability is triggered by a malformed ACL string, such as a bare

Defensive priority

Medium priority due to the potential for Denial of Service (DoS) attacks.

Recommended defensive actions

• Apply patches or updates provided by the vendor to fix the vulnerability in libarchive.
• Implement compensating controls, such as validating ACL strings before processing them.
• Monitor systems for potential Denial of Service (DoS) attacks.
• Consider using alternative libraries or APIs that are not vulnerable to this issue.
• Review the official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail provide information about the vulnerability in libarchive. The archive_acl_from_text_nl() function fails to perform adequate validation before advancing the pointer when processing a malformed ACL string, leading to a NULL pointer dereference vulnerability.

Official resources