Bug 2554209 (CVE-2026-17591)

Summary: CVE-2026-17591 libarchive: libarchive: use-after-free via aliased Mac metadata copy
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-16 16:53:23 UTC 
Summary: 
The flaw occurs when the source buffer passed to archive_entry_copy_mac_metadata() points to the internal Mac metadata buffer of the same archive_entry object. The function frees the internal buffer before copying from it, causing a UAF read during memcpy().

Requirements to exploit: An attacker need ability of reading and writing to a program using vulnarable libarchive entry API 

Component affected: https://github.com/libarchive/libarchive

Version affected: Commit hash 4840347 and previous versions. I didn't try on any release version. 

Patch Available: Yes

Version fixed: No release version has been confirmed fixed the flaw.But have a patch in upstream by PR #3318： https://github.com/libarchive/libarchive/pull/3318

Upstream coordination: Upstream was notified publicly through the following GitHub issue: https://github.com/libarchive/libarchive/issues/3313 And a fix was submitted and merged: https://github.com/libarchive/libarchive/pull/3318

Impact: A successful exploitation will make the program read wrong data from a freed buffer and then have logic problem. In addition, it probably can benefit chunk metadata leak for potential control flow hijack.

Embargo: No

Suggested public date: N/A, since the issue is already public.

Acknowledgement: Mr.Xin

Steps to reproduce:
1. Build the POC.c (source file is in the attachments): 
/usr/bin/clang -O1 -g \
 -fsanitize=address,undefined -fno-omit-frame-pointer \
 -I/path/to/libarchive/libarchive \
 /path/to/POC.c \
 /path/to/libarchive/LibBuilds/libarchive/libarchive.a \
 -lz -lbz2 -llzma -lzstd -lcrypto -lxml2 -lssl \
 -licui18n -licuuc -licudata -lm -lresolv \
 -o /output/path/POC_Executor

2. Run PoC
LLVM_SYMBOLIZER_BIN=/path/to/llvm-symbolizer
ASAN_OPTIONS="detect_leaks=0:halt_on_error=1:abort_on_error=1:symbolize=1:external_symbolizer_path=${LLVM_SYMBOLIZER_BIN}" \
 UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1 \
 /output/path/POC_Executor

Original report: https://github.com/libarchive/libarchive/issues/3313