Homepage

Double Free The advisory has been revoked - it doesn't affect any version of package bsdtar  (opens in a new tab)

Threat Intelligence

EPSS
0.79% (56th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-BSDTAR-17743009
  • published1 Jul 2026
  • disclosed24 May 2026
Report a new vulnerability Found a mistake?

Introduced: 24 May 2026

CVE-2026-14164  (opens in a new tab)
CWE-415  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream bsdtar package and not the bsdtar package as distributed by RHEL.

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

References