CVE-2026-5745

Name of the Vulnerable Software and Affected Versions libarchive (affected versions not specified)

Description A flaw exists in libarchive's ACL parsing logic within the archive acl from text nl() function. Insufficient validation when processing malformed ACL strings, such as a bare "d" or "default" tag without subsequent fields, leads to a NULL pointer dereference. An attacker can provide a crafted archive to cause a Denial of Service (DoS) in applications using the libarchive API, like bsdtar.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.