Description
libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).
Affected products
libarchive: libarchive; fedoraproject: fedora; apple: ipados; apple: iphone os; apple: macos; apple: watchos; splunk: universal forwarder
References10
- seclists.org/fulldisclosure/2022/Mar/27 Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2022/Mar/28 Mailing ListThird Party Advisory
- seclists.org/fulldisclosure/2022/Mar/29 Mailing ListThird Party Advisory
- bugs.chromium.org/p/oss-fuzz/issues/detail?id=32375 Issue TrackingThird Party Advisory
- github.com/google/oss-fuzz-vulns/blob/main/vulns/libarchive/OSV… Third Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.… Mailing ListThird Party Advisory
- security.gentoo.org/glsa/202208-26 Third Party Advisory
- support.apple.com/kb/HT213182 Third Party Advisory
- support.apple.com/kb/HT213183 Third Party Advisory
- support.apple.com/kb/HT213193 Third Party Advisory
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 3% percentile: 87 · as of 6 November 2026
- CWE
- CWE-416
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.