The libarchive library, which supports various archive formats including RAR5, contains two security flaws. CVE-2026-4111 is an infinite loop denial of service triggered during RAR5 decompression via the archive_read_data() function. CVE-2026-4424 is an information disclosure vulnerability caused by a heap out-of-bounds read during RAR archive processing. These vulnerabilities impact Red Hat Enterprise Linux 10.0 Extended Update Support across multiple CPU architectures. Red Hat has issued security advisories and updated packages to fix these issues. The vulnerabilities are rated as important/high severity by Red Hat, though no CVSS scores are provided in the advisory.

Successful exploitation of CVE-2026-4111 can cause denial of service by triggering an infinite loop during RAR5 decompression, potentially impacting availability. CVE-2026-4424 may allow an attacker to read sensitive memory contents due to a heap out-of-bounds read, leading to information disclosure. Both vulnerabilities affect systems using libarchive for processing RAR archives, including utilities like bsdtar and scripting language bindings. No known exploits in the wild have been reported at this time.

Red Hat has released updated libarchive packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 10.0 Extended Update Support and related products should apply these official security updates promptly. Detailed update instructions are available in the Red Hat advisory (RHSA-2026:8865) and associated knowledge base articles. No additional mitigation steps are indicated beyond applying the vendor-provided patches.