CVE-2026-17591 is a use-after-free vulnerability in libarchive affecting versions prior to 3.7.1-14.oe2403sp1. The flaw occurs in the archive_entry_copy_mac_metadata() function, where an internal buffer is deallocated before the data copy completes. This can lead to a Denial of Service (application crash) or potential information disclosure by reading uninitialized memory. The vulnerability has a low CVSS score of 3.6 and requires local attacker interaction with high attack complexity. A patch is available in version 3.7.1-14.oe2403sp1.