CVE-2026-14164 is a double free vulnerability in the RAR5 archive parsing logic of libarchive, specifically triggered by a stale filtered_buf pointer that is freed twice during unpacking state reinitialization. This can cause memory corruption leading to application crashes (denial of service) when processing crafted RAR5 archives. The vulnerability affects libarchive versions with RAR5 support starting from 3.4.0. Red Hat Enterprise Linux 10 includes affected versions, while earlier RHEL versions do not include RAR5 support and are not affected. Red Hat has issued security updates for libarchive in their Hardened Images RPMs to fix this issue. The CVSS v3.1 score assigned by Red Hat is 7.5 (high severity) reflecting network attack vector with no privileges or user interaction required and high availability impact.

Successful exploitation causes applications using the vulnerable libarchive API to terminate unexpectedly, resulting in denial of service. There is no impact on confidentiality or integrity. The vulnerability is particularly relevant in automated, network-facing environments where crafted RAR5 archives may be processed without user interaction. Standalone library use requires local user interaction to trigger the flaw, resulting in a lower impact rating. No known exploits are currently reported in the wild.

Red Hat has released updated libarchive packages (version 3.8.8-2.hum1) for their Hardened Images RPMs that address this vulnerability. Customers should apply these security updates once available. Currently, no alternative mitigations meet Red Hat's standards for usability and stability. Monitoring for vendor advisories and applying the official patch is the recommended course of action.