Double Free in libarchive RAR5 Reader

Executive Summary

CVE-2026-14164 is a double-free vulnerability in the libarchive library's RAR5 decompression logic. It occurs because the filtered_buf pointer, which points to a memory buffer used during decompression, may remain set after the memory it points to has been freed during unpacking state reinitialization.

When processing a specially crafted RAR5 archive, this stale pointer can cause the same memory region to be freed twice. This double-free condition can cause the application using libarchive to crash unexpectedly.

The root cause is that during the init_unpack() function, the filtered_buf memory is freed but the pointer is not cleared, leading to a dangling pointer. If a subsequent memory allocation fails, the cleanup process attempts to free the same memory again.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can cause applications using the vulnerable libarchive API to terminate unexpectedly, resulting in a denial of service (DoS).

The double-free condition can lead to memory corruption and crashes, which disrupt normal application operation.

In some cases, such memory corruption vulnerabilities may be leveraged for arbitrary code execution, although the primary impact described here is denial of service.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for crashes or abnormal termination of applications using the libarchive library when processing RAR5 archives, especially those that decompress RAR5 files with filters.

Using debugging tools such as AddressSanitizer can help identify double-free errors during testing or runtime.

A practical approach is to test the system with specially crafted RAR5 archives that trigger the double-free condition and observe if the application crashes or aborts.

No specific network commands are provided in the resources, but monitoring application logs for crashes related to libarchive or using memory debugging tools during decompression operations is recommended.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves updating the libarchive library to a version that includes the fix for CVE-2026-14164.

The fix prevents the dangling pointer from causing a double-free during the RAR5 decompression process, as merged in pull request #3071.

Until an update is applied, avoid processing untrusted or specially crafted RAR5 archives that could exploit this vulnerability.

Additionally, monitoring applications for crashes and applying any vendor patches or advisories related to libarchive is recommended.

Useful 0 Not Useful 0