CVE-2026-15028 is a vulnerability in libarchive on Red Hat Enterprise Linux 10. The flaw arises during the parsing of a PAX extended header with a malformed SUN.holesdata sparse-file attribute in a tar archive, leading to a heap overflow. This memory corruption issue can be exploited remotely by an attacker providing a crafted archive. The impact includes denial of service or possible arbitrary code execution, potentially allowing attacker control over the affected system. The CVSS 3.1 base score is 3.9, indicating low severity, with attack vector local, low attack complexity, low privileges required, and user interaction needed. No vendor advisory details on patch or remediation are currently provided.

Successful exploitation may cause a denial of service, making the system unavailable, or potentially allow arbitrary code execution, which could give an attacker control over the affected system. The CVSS score of 3.9 reflects a low severity impact with limited confidentiality and availability impact and no integrity impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15028 for current remediation guidance. No official fix or workaround information is provided in the available data.