{"id":"CVE-2026-17591","kind":"vulnerability","aliases":["CVE-2026-17591"],"related":[],"title":"libarchive: use-after-free in archive_entry_copy_mac_metadata crashes or leaks memory","description":"A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.","summary":"libarchive's archive_entry_copy_mac_metadata() frees an internal buffer before finishing a copy, leaving a use-after-free. An attacker who can feed archive input to an application using this function can crash it or read stale memory.","severity":"low","cvss":3.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c-library","libarchive","package"],"not_affected_if":["no-untrusted-archives"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T23:17:01+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:45:31+00:00","updated_at":"2026-10-25T04:45:31+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:45:31Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"libarchive: use-after-free in archive_entry_copy_mac_metadata crashes or leaks memory","impact":"low","summary":"libarchive's archive_entry_copy_mac_metadata() frees an internal buffer before finishing a copy, leaving a use-after-free. An attacker who can feed archive input to an application using this function can crash it or read stale memory.","category":"package","nicknames":[],"who_cares":["libarchive","c-library"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Application crashes, or stale memory contents are disclosed to the attacker","analyst_note":"Find affected libarchive version range and fixed release from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-17591) and upstream libarchive advisories.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-untrusted-archives"],"who_is_affected":"Applications that link libarchive and pass attacker-supplied archive entries with macOS metadata into archive_entry_copy_mac_metadata(). Systems that only extract archives you trust, or that do not use this function, are less exposed. The sources do not name affected versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00057,"input_tokens":3344,"output_tokens":471,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-17591':18A,21A '-2026':17A,20A 'alreadi':104C 'applic':57B,135C,146C 'archiv':7A,29B,53B,112C 'aris':109C 'attack':49B,75C,128C 'buffer':37B,121C 'c':23B 'c-librari':22B 'caus':77C 'complet':123C 'copi':9A,31B,41B,114C,126C 'crash':12A,62B,144C 'cve':16A,19A 'data':125C,151C 'dealloc':118C 'denial':79C 'disclosur':86C 'dos':82C 'due':87C 'entri':8A,30B,113C 'feed':52B 'finish':39B 'flaw':69C,142C 'found':71C 'free':5A,34B,47B,93C 'function':60B,117C,138C 'inform':85C 'input':54B,132C 'intern':36B,120C 'issu':108C 'leak':14A 'leav':42B 'libarch':1A,25B,27B,73C 'librari':24B 'mac':10A,32B,115C 'memori':15A,67B,101C,150C 'metadata':11A,33B,116C 'occur':96C 'packag':26B 'potenti':84C 'program':99C 'read':65B,100C,148C 'releas':106C 'servic':81C 'stale':66B 'suppli':131C 'trigger':140C 'uniniti':149C 'use':3A,45B,58B,91C 'use-after-fre':2A,44B,90C 'util':136C 'vulner':94C","nicknames":[],"mitigations":[],"who_affected":"Applications that link libarchive and pass attacker-supplied archive entries with macOS metadata into archive_entry_copy_mac_metadata(). Systems that only extract archives you trust, or that do not use this function, are less exposed. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T23:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-17591","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17591","severity":null,"published_at":"2026-10-16T23:17:01+00:00","modified_at":"2026-10-19T22:17:10+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}