CVE-2026-17591

A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.

This vulnerability is rated as Low severity for Red Hat because successful exploitation requires highly specific application-level API usage where an archive entry's metadata buffer is explicitly copied onto itself. Standard command-line archive utilities and typical library consumers do not perform this aliased operation during regular archive extraction or creation. Consequently, the flaw presents minimal exposure in standard Red Hat Enterprise Linux environments, with potential impact limited to localized crashes or minor memory leakage in custom applications invoking the affected API pattern.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.