Bug 2497970 (CVE-2026-15028)

Summary:	CVE-2026-15028 libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2500620, 2500621, 2500622
Bug Blocks:
Deadline:	2026-07-20

Description OSIDB Bzimport 2026-07-08 07:06:55 UTC

Hello Red Hat PSIRT,

I would like to request CVE assignment for a security vulnerability I found in libarchive.

There is a heap overflow problem while parsing a tar archive that contains a PAX extended header with the SUN.holesdata sparse-file attribute. header_pax_extension() passes the attribute value to pax_attribute() with the trailing newline excluded from the value length. The SUN.holesdata parser later treats the byte after the supplied value as if it were still part of the accessible buffer and reads it when length == 0.

More detail can be found in github issue: https://github.com/libarchive/libarchive/issues/3251
A fixed PR has been commit: https://github.com/libarchive/libarchive/pull/3253

Until send this email, I have search no public report of this flaw. I want to know if it can be assgned a CVE ID or do you need any other more detail informations.

Best regards,
Bon Voyage