CVE-2026-14164

Publication date 30 June 2026

Last updated 6 August 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.5 · High

Score breakdown

Description

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

Status

Package Ubuntu Release Status
libarchive 26.04 LTS resolute
Fixed 3.8.5-1ubuntu2.2
25.10 questing Ignored end of life, was needs-triage
24.04 LTS noble
Fixed 3.7.2-2ubuntu0.8
22.04 LTS jammy
Fixed 3.6.0-1ubuntu1.8
20.04 LTS focal
Fixed 3.4.0-2ubuntu1.5+esm3
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected
14.04 LTS trusty
Not affected

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libarchive

Severity score breakdown

CVSS version: CVSS v3.0

Base score 7.5 · High

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-8581-1
    • libarchive vulnerabilities
    • 21 July 2026

Other references

Access our resources on patching vulnerabilities