libarchive Remote Code Execution Vulnerability
Summary
CERT-Bund issued Security Advisory WID-SEC-2026-0923 warning of a high-severity remote code execution vulnerability in libarchive, a C library used for reading and creating archive formats including tar, cpio, zip, and ISO. The vulnerability has a CVSS Base Score of 7.3 and affects systems running Linux, UNIX, and Windows. Organizations using libarchive should apply available mitigations immediately.
What changed
CERT-Bund published Security Advisory WID-SEC-2026-0923 identifying a remote code execution vulnerability in libarchive, an open-source C library for handling archive formats (tar, cpio, zip, ISO, and others). The vulnerability carries a CVSS Base Score of 7.3 (high) and CVSS Temporal Score of 6.4 (medium). Remote attackers can exploit this flaw to execute arbitrary code on affected systems.
Organizations using libarchive on Linux, UNIX, or Windows platforms should immediately verify their exposure, check for available patches or updates, and apply mitigations where patches are not yet available. Given the CVSS 7.3 severity, unpatched systems face significant risk of compromise through specially crafted archive files.
What to do next
- Identify systems running libarchive across Linux, UNIX, and Windows environments
- Apply available patches or updates for libarchive to remediate the vulnerability
- If patches are unavailable, implement compensating controls such as input validation and restricting processing of untrusted archive files
Source document (simplified)
[WID-SEC-2026-0923] libarchive: Schwachstelle ermöglicht Codeausführung CVSS Base Score 7.3 (hoch) CVSS Temporal Score 6.4 (mittel) Remoteangriff ja Datum 30.03.2026 Stand 31.03.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- Linux
- UNIX
- Windows
Produktbeschreibung
libarchive ist eine C Bibliothek und ein Kommandozeilen-Tool zum Lesen und Bearbeiten von tar, cpio, zip, ISO und anderen Formaten.
Produkte
30.03.2026
- Open Source libarchive
Angriff
Angriff
Ein entfernter Angreifer kann eine Schwachstelle in libarchive ausnutzen, um beliebigen Programmcode auszuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get Data Privacy & Cybersecurity alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.