PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5121 Redhat CVE debrief

CVE-2026-5121 is a high-severity libarchive flaw affecting zisofs block pointer allocation logic on 32-bit systems. A specially crafted ISO9660 image can trigger an integer overflow that may become a heap buffer overflow, so systems that process untrusted images should treat this as a priority patch item. The NVD record was published on 2026-03-30 and last modified on 2026-05-11, with Red Hat advisories and an upstream fix referenced in the record.

Vendor
Redhat
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-30
Original CVE updated
2026-09-01
Advisory published
2026-03-30
Advisory updated
2026-09-01

Who should care

Administrators and developers who ship or consume libarchive, especially on 32-bit builds or on systems that parse ISO9660 images. This also matters for teams managing the Red Hat products listed in the NVD CPE data, including RHEL 6-10, OpenShift Container Platform 4.0, and hardened_images.

Technical summary

The supplied sources describe an integer overflow in libarchive's zisofs block pointer allocation logic on 32-bit systems. According to the CVE description, a remote attacker can exploit the issue by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow and potentially arbitrary code execution. NVD assigns CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps the issue to CWE-190.

Defensive priority

High. The flaw is remotely triggerable, requires no privileges or user interaction per the supplied CVSS vector, and affects parsing of attacker-controlled image content.

Recommended defensive actions

  • Apply the vendor security updates referenced by the Red Hat advisories in the NVD record.
  • Update or backport the upstream libarchive fix referenced by the linked project patch and ensure downstream packages include it.
  • Inventory where libarchive is used, including embedded copies in application stacks, containers, and OS packages.
  • Prioritize 32-bit deployments and builds, since the integer overflow is reported on 32-bit systems.
  • Limit processing of untrusted ISO9660 images and restrict where externally supplied archive content can be opened or mounted.
  • After patching, re-verify package versions and rerun your normal security validation checks for libarchive consumers.

Evidence notes

This debrief is based only on the supplied NVD record and its referenced Red Hat and project links. The record identifies libarchive as the affected component, cites CWE-190, and lists multiple Red Hat errata plus the upstream libarchive pull request as references. No public exploitation or KEV entry is included in the provided corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5121 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5121

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5121 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5121

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.