This Red Hat security advisory (RHSA-2026:8944) announces an update to Red Hat Hardened Images RPMs, specifically multiple libarchive packages (bsdcat, bsdcpio, bsdtar, bsdunzip, libarchive, and libarchive-devel) version 3.8.7-1.hum1 for aarch64 and x86_64 architectures. The update addresses multiple vulnerabilities including CVE-2025-60753 and five additional CVEs from 2026. The advisory does not provide detailed technical descriptions of the vulnerabilities or explicit patch version ranges. The update is classified as a bug fix and enhancement. No known exploits have been reported. The vendor advisory does not explicitly confirm patch availability or remediation status beyond the update release.

The vulnerabilities addressed are considered high severity and relate to multiple weaknesses (CWE-835, CWE-125, CWE-1335, CWE-190, CWE-476) affecting libarchive components in Red Hat Hardened Images. These could potentially lead to issues such as memory corruption, out-of-bounds reads, integer overflows, or null pointer dereferences. However, no active exploitation is known. The impact is limited to affected Red Hat Hardened Images RPMs on aarch64 and x86_64 platforms.

Red Hat has released updated RPM packages (version 3.8.7-1.hum1) for the affected libarchive components. Users of Red Hat Hardened Images should apply these updates as provided by Red Hat to remediate the vulnerabilities. Since this is an official Red Hat security advisory with updated packages, applying the vendor-provided updates is the recommended mitigation. Patch status is implied by the availability of updated RPMs, but explicit patch confirmation should be verified via the official Red Hat advisory links.