Library libarchive has vulnerability CVE-2026-14164
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 23.6k
- Forks
- 2.6k
- Avg merge
- 6d 7h
- Merged PRs (30d)
- 14
Description
https://nvd.nist.gov/vuln/detail/CVE-2026-14164
A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
NOTE: This is an automated issue created based on the library metadata. Osquery may or may not be affected.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked NVD entry and inspect how osquery obtains and uses libarchive, focusing on whether the vulnerable RAR5 reader is included or reachable. The issue is resolved when osquery's exposure to CVE-2026-14164 is determined and any required remediation is verified; the payload does not name a source file or test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, cpp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100