An integer overflow in the zisofs block pointer allocation logic of libarchive on 32-bit Red Hat Enterprise Linux 7 Extended Lifecycle Support systems allows a remote attacker to cause a heap buffer overflow by supplying a crafted ISO9660 image. This can lead to arbitrary code execution. The vulnerability is tracked as CVE-2026-5121 with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Red Hat has issued multiple security advisories and updates to address this issue. The vulnerability is not known to be exploited in the wild. The vendor advisories provide updated packages and instructions for remediation.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on a vulnerable 32-bit Red Hat Enterprise Linux 7 Extended Lifecycle Support system by providing a malicious ISO9660 image. This compromises the confidentiality of the system (high impact on confidentiality) but does not directly affect integrity or availability according to the CVSS vector. There are no known exploits in the wild at this time.

Red Hat has released security advisories with updated libarchive packages that fix this vulnerability. Users of Red Hat Enterprise Linux 7 Extended Lifecycle Support on 32-bit systems should apply the relevant security updates as provided in the Red Hat advisories (e.g., RHSA-2026:10065 and others linked). Patch status is confirmed as fixed by Red Hat. No additional mitigation steps are required beyond applying the official patches.