Changeflow GovPing Data Privacy & Cybersecurity libarchive Remote Code Execution Vulnerability
Priority review Notice Added Final

libarchive Remote Code Execution Vulnerability

Favicon for wid.cert-bund.de CERT-Bund Security Advisories
Published March 30th, 2026
Detected March 31st, 2026
Email

Summary

CERT-Bund issued Security Advisory WID-SEC-2026-0923 warning of a high-severity remote code execution vulnerability in libarchive, a C library used for reading and creating archive formats including tar, cpio, zip, and ISO. The vulnerability has a CVSS Base Score of 7.3 and affects systems running Linux, UNIX, and Windows. Organizations using libarchive should apply available mitigations immediately.

What changed

CERT-Bund published Security Advisory WID-SEC-2026-0923 identifying a remote code execution vulnerability in libarchive, an open-source C library for handling archive formats (tar, cpio, zip, ISO, and others). The vulnerability carries a CVSS Base Score of 7.3 (high) and CVSS Temporal Score of 6.4 (medium). Remote attackers can exploit this flaw to execute arbitrary code on affected systems.

Organizations using libarchive on Linux, UNIX, or Windows platforms should immediately verify their exposure, check for available patches or updates, and apply mitigations where patches are not yet available. Given the CVSS 7.3 severity, unpatched systems face significant risk of compromise through specially crafted archive files.

What to do next

  1. Identify systems running libarchive across Linux, UNIX, and Windows environments
  2. Apply available patches or updates for libarchive to remediate the vulnerability
  3. If patches are unavailable, implement compensating controls such as input validation and restricting processing of untrusted archive files

Source document (simplified)

[WID-SEC-2026-0923] libarchive: Schwachstelle ermöglicht Codeausführung CVSS Base Score 7.3 (hoch) CVSS Temporal Score 6.4 (mittel) Remoteangriff ja Datum 30.03.2026 Stand 31.03.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

  • Linux
  • UNIX
  • Windows

Produktbeschreibung

libarchive ist eine C Bibliothek und ein Kommandozeilen-Tool zum Lesen und Bearbeiten von tar, cpio, zip, ISO und anderen Formaten.

Produkte

30.03.2026
- Open Source libarchive

Angriff

Angriff

Ein entfernter Angreifer kann eine Schwachstelle in libarchive ausnutzen, um beliebigen Programmcode auszuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben

Source

Analysis generated by AI. Source diff and links are from the original.

Classification

Agency
CERT-Bund
Published
March 30th, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Minor
Document ID
WID-SEC-2026-0923

Who this affects

Applies to
Technology companies Government agencies
Industry sector
5112 Software & Technology
Activity scope
Software Vulnerability Management IT Security Operations
Geographic scope
Germany DE

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Consumer Protection

Get Data Privacy & Cybersecurity alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.

Get alerts for this source

We'll email you when CERT-Bund Security Advisories publishes new changes.

Optional. Personalizes your daily digest.

Free. Unsubscribe anytime.