CVE-2026-14164 is a double-free vulnerability in libarchive's RAR5 reader caused by a stale filtered_buf pointer after freeing during unpacking state reinitialization. Processing a specially crafted RAR5 archive can trigger a second free of the same memory region, leading to a double-free condition. This can cause applications using libarchive to terminate unexpectedly, resulting in denial of service. The vulnerability affects libarchive versions from 3.4.0 onward, as earlier versions do not support RAR5 and are not vulnerable. Red Hat Enterprise Linux 6, 7, and 8 ship libarchive versions prior to 3.4.0 and are therefore not affected. Red Hat assigned a CVSS v3 score of 7.5 (High) based on typical deployment scenarios where libarchive is embedded in automated, network-accessible services processing remote archives. From a standalone library perspective, the score is lower (5.5) due to local attack vector and user interaction requirements. Red Hat has released updated libarchive packages (version 3.8.8-2.hum1) for their Hardened Images to fix this issue. No alternative mitigations are currently available.

Successful exploitation of this vulnerability can cause applications using the vulnerable libarchive API to crash unexpectedly, resulting in denial of service. There is no impact on confidentiality or integrity. The vulnerability is exploitable remotely in typical Red Hat deployment environments where libarchive processes archives automatically from network sources without user interaction. In standalone use, exploitation requires local access and user interaction. No known exploits are currently in the wild.

Red Hat has released updated libarchive packages (version 3.8.8-2.hum1) for their Hardened Images that address this vulnerability. Customers are advised to apply these security updates promptly. No other mitigations meeting Red Hat's standards for usability and stability are currently available.