Red Hat libarchive Update Fixes Two RHEL 10 Flaws
Tech GuruQuick Answer
RHSA-2026:69553 updates RHEL 10 libarchive to 3.7.7-11.el10_2. It addresses two Low-rated flaws in different archive paths: reading tar PAX extended headers and writing ZIP headers.
Confirm Scope And Apply The Supported Fix
What to do now: Update installed libarchive packages from the applicable RHEL 10 repository, then check the tools and services that read or create archives through the library.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 10 libarchive packages |
|---|---|
| Advisory | RHSA-2026:69553 |
| CVEs | CVE-2026-15028, CVE-2026-16517 |
| Authoritative release date | RHSA-2026:69553: 2026-09-21T23:38:41+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69553: 2026-09-21T23:38:41+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | The RHEL 10 libarchive packages covered by RHSA-2026:69553 before 3.7.7-11.el10_2. |
| Fixed version | libarchive 3.7.7-11.el10_2 |
| CVSS base score | 2.9 / 3.9 (CVSS v3.1) |
| CVSS severity | Low |
| Exploitation status | RHSA-2026:69553 does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
CVE-2026-15028 is an out-of-bounds read with limited confidentiality/availability impact; CVE-2026-16517 is a signed integer overflow with low availability impact. These findings do not establish remote code execution. Review both archive consumers and archive-producing jobs.
What To Validate Now
- Inventory. Record installed libarchive packages and tools using them for tar extraction, ZIP creation, backup or import workflows.
- Establish applicability. Match the RHEL repository and installed RPM release to RHSA-2026:69553; the read-side and write-side CVEs have different prerequisites.
- Remediate. Apply libarchive 3.7.7-11.el10_2 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the full RPM release and test representative tar extraction and ZIP creation workflows, including dependent backup/import jobs. Preserve results and any compatibility exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
