CVE-2026-15028
A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.
- CVSS 3.1
- 3.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-805, CWE-122
- Published
- Modified
- Record from
- the NVD, synced