CVE-2026-42496 is a critical vulnerability in Archive::Tar for Perl (versions before 3.08) involving improper link resolution before file access (CWE-59). The _make_special_file() function passes the tar header's linkname directly to symlink() without validating for absolute paths or '..' segments, allowing crafted symlinks to point outside the extraction directory. The secure-extract mode does not cover symlink targets, enabling attackers to create symlinks that lead to arbitrary file access when subsequently opened. Red Hat has published advisories and provided updated perl-Archive-Tar packages (version 3.02-512.el10_2.1) for Red Hat Enterprise Linux 10 and related variants to mitigate this issue.

Successful exploitation allows an attacker to create symbolic links during archive extraction that point to arbitrary file system locations outside the intended extraction directory. This can lead to unauthorized read or write operations on files chosen by the attacker, potentially compromising system confidentiality and integrity. The CVSS v3.1 base score is 9.1, reflecting high impact on confidentiality and integrity with no required privileges or user interaction.

Red Hat has released updated perl-Archive-Tar packages that fix this vulnerability. Users of affected Red Hat Enterprise Linux 10 variants should apply the security update (perl-Archive-Tar-3.02-512.el10_2.1) as detailed in the Red Hat advisories RHSA-2026:30856 and RHSA-2026:30857. Patch status is official-fix via vendor-provided updates. No additional mitigation is required beyond applying the vendor's security update.