CVE-2026-5121: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-5121 is an integer overflow vulnerability in libarchive's zisofs block pointer allocation logic, affecting 32-bit systems. A remote attacker can exploit this flaw by supplying a specially crafted ISO9660 image, triggering a heap buffer overflow that could lead to arbitrary code execution. The vulnerability was disclosed on March 30, 2026, and affects libarchive across multiple distributions including Red Hat Enterprise Linux 6–10, OpenShift Container Platform 4, IBM MQ Operator container images, and IBM Guardium Data Protection. The GitHub Advisory Database (GHSA-2vwv-vqpv-v8vc) assigns a CVSS v3.1 base score of 9.8 (Critical), while Red Hat's NVD entry scores it 7.5 (High) (Red Hat CVE, Github Advisory).

The root cause is an integer overflow (CWE-190) in zisofs_read_data() within libarchive's ISO9660 parser. The Rock Ridge ZF extension stores pz_log2_bs as a raw byte (0–255) in parse_rockridge_ZF1(), but the zisofs specification only permits values 15–17. When a crafted ISO sets pz_log2_bs=2 and pz_uncompressed_size=0xFFFFFFF9, the block pointer count calculation (ceil + 1) * 4 wraps to 0 on 32-bit systems (where sizeof(size_t) == 4), causing malloc(0) to return a tiny buffer. The subsequent write of approximately 4 GB of data into this buffer constitutes a heap buffer overflow write. On 64-bit systems, the overflow does not wrap and the allocation either succeeds safely or returns ARCHIVE_FATAL. No authentication or user interaction is required — the attacker only needs to supply a malicious ISO9660 image to a system or service that processes it with libarchive (libarchive PR #2934, Github Advisory).

Successful exploitation on a vulnerable 32-bit system can result in arbitrary code execution with the privileges of the process parsing the ISO9660 image, enabling full system compromise. The heap buffer overflow write allows an attacker to corrupt memory structures, potentially leading to control-flow hijacking. Confidentiality, integrity, and availability of the affected system are all at risk, and downstream services or users relying on libarchive-based tools (e.g., bsdtar, desktop file managers, package managers) could be affected if they process attacker-supplied archive files (Red Hat RHSA-2026:8510, Github Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.24% (Feedly data) to 0.055% (GitHub Advisory), placing it in a low-to-moderate exploitation probability range. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability is detected by multiple Nessus and Qualys scanner plugins, indicating broad scanner coverage (Github Advisory).

1. Craft a malicious ISO9660 image: Using a Python script or similar tool, construct a 48 KB ISO9660 image with a Rock Ridge ZF extension where pz_log2_bs=2 (out-of-spec; valid range is 15–17) and pz_uncompressed_size=0xFFFFFFF9.
2. Deliver the ISO to the target: Upload or serve the crafted ISO to a 32-bit system running a vulnerable version of libarchive, via any vector that causes the system to process the file (e.g., file manager auto-preview, archive extraction utility, package manager, or a web service that processes user-uploaded archives).
3. Trigger ISO parsing: Cause libarchive to open and parse the ISO, for example by running bsdtar -xf malicious.iso or by having a file manager or application automatically process the file.
4. Integer overflow triggers heap overflow: During zisofs_read_data(), the block pointer count calculation (ceil + 1) * 4 wraps to 0 on 32-bit systems, malloc(0) returns a tiny buffer, and libarchive writes approximately 4 GB of data past the buffer boundary, corrupting heap memory.
5. Achieve code execution: Exploit the heap corruption to redirect control flow, enabling arbitrary code execution as the user or service account running the libarchive-based process (libarchive PR #2934).

• File System: Presence of unexpected or anomalous .iso files in upload directories, temporary folders, or locations accessible to archive-processing services.
• Process: Crashes or abnormal termination of libarchive-based processes (e.g., bsdtar, file manager daemons) on 32-bit systems, particularly with segmentation faults or heap corruption errors in logs.
• Logs: Application or system logs showing ARCHIVE_FATAL errors or memory allocation failures during ISO9660 image processing; ASAN/sanitizer reports of heap-buffer-overflow WRITE in zisofs_read_data().
• Network: Unusual inbound file transfers of ISO images to services that process archives, especially from untrusted or external sources.

The fix was merged into libarchive's master branch on April 12, 2026 (PR #2934), and is included in libarchive version 3.8.7. The fix validates pz_log2_bs to the spec-permitted range of 15–17 in parse_rockridge_ZF1(), preventing the integer overflow. Red Hat issued multiple security advisories (RHSA-2026:8510 for RHEL 9, RHSA-2026:8517 for RHEL 7 ELS, and numerous others for RHEL 8/10 and OpenShift) with updated packages (e.g., libarchive-3.5.3-9.el9_7). Debian, Ubuntu (USN-8292-1), SUSE, Amazon Linux 2, and AlmaLinux have also released patched packages. As an interim workaround, restrict access to ISO9660 image processing functionality and prevent untrusted ISO9660 files from reaching vulnerable 32-bit systems via network-level controls (libarchive PR #2934, Red Hat RHSA-2026:8510, Github Advisory).

Red Hat rated the vulnerability as "Important" severity and issued a broad set of errata across RHEL 6–10 and OpenShift. IBM published advisories for affected MQ Operator container images and Guardium Data Protection. The Yocto Project security list and multiple Linux distribution security teams (Debian, Ubuntu, SUSE, openSUSE, AlmaLinux, Amazon Linux) also issued advisories. Community discussion was noted on Mastodon and Bluesky, and German Linux news outlet Pro-Linux.de covered the issue in multiple articles. No significant controversy or researcher disagreement was observed (Red Hat RHSA-2026:8510, IBM Advisory).