Heap Overflow in libarchive via Malformed PAX Header

Executive Summary

CVE-2026-15028 is a vulnerability in the libarchive library's tar PAX reader that causes a heap buffer out-of-bounds (OOB) read. It happens when parsing a specially crafted tar archive containing a PAX extended header with the SUN.holesdata sparse-file attribute. The parser incorrectly handles the length of this attribute's value, leading to reading one byte beyond the allocated buffer.

Specifically, the function pax_attribute_SUN_holesdata reads a byte after the end of the buffer if the final number in the SUN.holesdata value exactly consumes the entire buffer. This results in a heap-buffer-overflow condition.

The vulnerability can be triggered remotely by providing a malicious tar archive, and it was confirmed using AddressSanitizer tools.

Useful 0 Not Useful 0

Impact Analysis

Successful exploitation of this vulnerability can lead to a denial of service (DoS), making the affected system unavailable.

Additionally, it may allow an attacker to execute arbitrary code on the affected system, potentially gaining control over it.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by analyzing tar archives for specially crafted PAX extended headers containing the SUN.holesdata sparse-file attribute that trigger heap buffer overflows during parsing.

Detection can involve monitoring or testing the libarchive tar parsing functionality with crafted tar files that include malformed SUN.holesdata attributes to observe if heap-buffer-overflow errors occur.

Using debugging tools such as AddressSanitizer while processing suspicious tar archives can help identify the heap-buffer-overflow condition.

No specific commands are provided in the resources, but a practical approach is to run the tar extraction or libarchive-based archive_read_open() calls on test archives with crafted PAX headers and monitor for crashes or sanitizer reports.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves updating libarchive to a version that includes the fix merged on July 7, 2026, which prevents the out-of-bounds read by properly validating buffer boundaries during parsing.

Until the update is applied, avoid processing untrusted or suspicious tar archives containing PAX extended headers with the SUN.holesdata attribute.

Monitoring for patches or security advisories from libarchive or your operating system vendor and applying them promptly is recommended.

Useful 0 Not Useful 0