This vulnerability involves an integer overflow in the zisofs block pointer allocation logic of libarchive on 32-bit Red Hat Enterprise Linux 7 Extended Lifecycle Support systems. When processing a maliciously crafted ISO9660 image, the integer overflow can trigger a heap buffer overflow. This memory corruption could allow a remote attacker to execute arbitrary code on the affected system without requiring user interaction or privileges. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, and no privileges or user interaction needed. Multiple Red Hat advisories reference this CVE, indicating vendor awareness and ongoing updates related to affected products.

Successful exploitation can lead to arbitrary code execution on affected 32-bit systems running Red Hat Enterprise Linux 7 Extended Lifecycle Support. This compromises system confidentiality and integrity by allowing remote attackers to execute code remotely without authentication or user interaction. The vulnerability does not directly impact availability according to the CVSS vector. No known exploits in the wild have been reported at this time.

Red Hat has published multiple security advisories referencing CVE-2026-5121. Users should consult the official Red Hat advisories (e.g., https://access.redhat.com/errata/RHSA-2026:10065 and related links) for the latest patches and updates. Since this is not a cloud service, remediation requires applying vendor-provided patches or updates to libarchive on affected systems. Patch status is not explicitly confirmed in the provided advisory content; therefore, users must verify the current remediation guidance directly from Red Hat's security advisories and errata. Until patches are applied, avoid processing untrusted ISO9660 images on vulnerable 32-bit systems.