CVE-2026-15028 is a heap overflow vulnerability in libarchive that can be triggered by parsing a malicious tar archive with a malformed PAX extended header containing a SUN.holesdata sparse-file attribute. This flaw can lead to denial of service or, in complex scenarios, arbitrary code execution. Exploitation requires that a user or automated system actively parses the crafted archive using libarchive, meaning the attacker cannot trigger it remotely without interaction. The vulnerability affects libarchive versions included in Red Hat Hardened Images RPMs for aarch64 and x86_64 architectures. Red Hat has issued updated packages (version 3.8.8-2.1.hum1) to fix this issue. The CVSS v3.1 base score assigned by Red Hat is 3.9 (medium severity), reflecting local attack vector with low privileges required and user interaction needed.

The vulnerability can cause a denial of service by crashing applications that parse the malicious tar archive. In some cases, it may allow an attacker to execute arbitrary code, potentially gaining control over the affected system. However, reliable exploitation for code execution is complex and depends on the memory layout and protections of the target application. The attack requires user interaction or a specific application workflow to process the crafted archive, limiting remote exploitation capabilities.

Red Hat has released updated libarchive RPM packages (version 3.8.8-2.1.hum1) for affected architectures to address this vulnerability. Users should apply these updates as soon as possible. Until patched, avoid processing untrusted or unverified tar archives, especially those from unknown sources or with unexpected content. Exercise caution when handling such archives to prevent triggering the vulnerability.