CVE-2026-17591: libarchive: use-after-free in MAC metadata copy causes DoS

LOW

Published October 16, 2026

CISO Take

libarchive has a use-after-free in archive_entry_copy_mac_metadata(). The function frees an internal buffer before it finishes copying, so a crafted archive can crash the application or expose uninitialized memory. The risk is low: CVSS is 3.6, the attack is local with high complexity, and the user has to open the archive. There is no public exploit, no Nuclei template, and no KEV listing, and EPSS and SSVC data are not available. The reach is wide, though. libarchive has 695 downstream dependents, 142 other CVEs in the same package, and an OpenSSF Scorecard of 5.4/10. It is bundled in dozens of Red Hat OpenShift AI (rhoai) container images, including MLflow, KServe, the notebook controllers, and the training and model-registry operators. Apply the Red Hat update (RHSA-2026:77775) through your normal patch cycle. Prioritize any workload that unpacks untrusted archives, such as model or dataset uploads and notebook imports.

Sources:NVDRed HatOpenSSFATLASGitHub

What is the risk?

Low overall. The CVSS vector is AV:L/AC:H/PR:N/UI:R, with low confidentiality and availability impact and no integrity impact. Exploitation needs a user or an automated process to handle an attacker-supplied archive on the host. EPSS is unavailable, and there is no public exploit, scanner template, or KEV listing. Exposure rises for AI platforms that automatically ingest user-supplied archives (model artifacts, datasets, notebook bundles), because the user-interaction requirement is then effectively met by automation. The impact is limited to a crash or a small read of uninitialized memory, which is not reliable enough for targeted data theft.

How does the attack unfold?

Initial Access

The attacker supplies a crafted archive with malformed Mac metadata through a model, dataset, or notebook upload path.

AML.T0011.000

Exploitation

A user or pipeline extracts the archive, and archive_entry_copy_mac_metadata() frees its buffer before the copy completes, triggering the use-after-free.

AML.T0010.001

Impact

The extracting process crashes, interrupting AI pipelines or serving, or it reads stale memory contents.

AML.T0029

Initial Access

The attacker supplies a crafted archive with malformed Mac metadata through a model, dataset, or notebook upload path.

AML.T0011.000

Exploitation

A user or pipeline extracts the archive, and archive_entry_copy_mac_metadata() frees its buffer before the copy completes, triggering the use-after-free.

AML.T0010.001

Impact

The extracting process crashes, interrupting AI pipelines or serving, or it reads stale memory contents.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago15% patched~68d to patchFull package profile →
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago15% patched~68d to patchFull package profile →
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago15% patched~68d to patchFull package profile →
libarchive	—	—	No patch
libarchive-main	—	—	No patch
rhoai/odh-ai-gateway-operator-rhel9	—	—	No patch
rhoai/odh-core-bff-rhel9	—	—	No patch
rhoai/odh-dashboard-operator-rhel9	—	—	No patch
rhoai/odh-dashboard-rhel9	—	—	No patch
rhoai/odh-data-science-pipelines-operator-controller-rhel9	—	—	No patch
rhoai/odh-kf-notebook-controller-rhel9	—	—	No patch
rhoai/odh-kserve-controller-rhel9	—	—	No patch
rhoai/odh-kserve-llmisvc-controller-rhel9	—	—	No patch
rhoai/odh-kserve-module-operator-rhel9	—	—	No patch
rhoai/odh-kube-rbac-proxy-rhel9	—	—	No patch
rhoai/odh-kuberay-operator-controller-rhel9	—	—	No patch
rhoai/odh-llama-stack-k8s-operator-rhel9	—	—	No patch
rhoai/odh-maas-controller-rhel9	—	—	No patch
rhoai/odh-mod-arch-agent-ops-rhel9	—	—	No patch
rhoai/odh-mod-arch-automl-rhel9	—	—	No patch
rhoai/odh-mod-arch-autorag-rhel9	—	—	No patch
rhoai/odh-mod-arch-eval-hub-rhel9	—	—	No patch
rhoai/odh-mod-arch-gen-ai-rhel9	—	—	No patch
rhoai/odh-mod-arch-maas-rhel9	—	—	No patch
rhoai/odh-mod-arch-model-registry-rhel9	—	—	No patch
rhoai/odh-model-controller-rhel9	—	—	No patch
rhoai/odh-model-registry-operator-rhel9	—	—	No patch
rhoai/odh-model-serving-api-rhel9	—	—	No patch
rhoai/odh-notebook-controller-rhel9	—	—	No patch
rhoai/odh-ogx-k8s-operator-rhel9	—	—	No patch
rhoai/odh-ogx-module-operator-rhel9	—	—	No patch
rhoai/odh-training-operator-rhel9	—	—	No patch
rhoai/odh-trustyai-service-operator-rhel9	—	—	No patch
rhoai/odh-workbenches-operator-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

3.6 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACHigh

PRNone

UIRequired

SUnchanged

CLow

INone

ALow

What should I do?

1 step

1) Apply the Red Hat errata RHSA-2026:77775 and rebuild or redeploy the affected rhoai images. 2) For custom images, update libarchive to a build containing the fix from upstream pull request 3318. 3) Inventory images and SBOMs for libarchive, including the 'main' branch builds listed. 4) Restrict archive extraction in AI pipelines to trusted or scanned sources, and run extraction in sandboxed, low-privilege containers with resource limits. 5) Monitor for repeated crashes or restarts (segfaults, CrashLoopBackOff) in controllers and workbenches that handle archives. 6) Track the Red Hat Bugzilla entry 2554209 for fixed-version details.

How is it classified?

DoSData LeakageSupply ChainFrameworkInferenceAML.T0010.001- AI Software AML.T0011.000- Unsafe AI Artifacts AML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies and procedures address third-party AI risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-17591?

Is CVE-2026-17591 actively exploited?

No confirmed active exploitation of CVE-2026-17591 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-17591?

1) Apply the Red Hat errata RHSA-2026:77775 and rebuild or redeploy the affected rhoai images. 2) For custom images, update libarchive to a build containing the fix from upstream pull request 3318. 3) Inventory images and SBOMs for libarchive, including the 'main' branch builds listed. 4) Restrict archive extraction in AI pipelines to trusted or scanned sources, and run extraction in sandboxed, low-privilege containers with resource limits. 5) Monitor for repeated crashes or restarts (segfaults, CrashLoopBackOff) in controllers and workbenches that handle archives. 6) Track the Red Hat Bugzilla entry 2554209 for fixed-version details.

What systems are affected by CVE-2026-17591?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps platforms, notebook/workbench environments, model registries, Kubernetes-based AI operators.

What is the CVSS score for CVE-2026-17591?

CVE-2026-17591 has a CVSS v3.1 base score of 3.6 (LOW).

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesMLOps platformsnotebook/workbench environmentsmodel registriesKubernetes-based AI operators

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0011.000Unsafe AI Artifacts

AML.T0029Denial of AI Service

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.

Exploitation Scenario

An attacker uploads a malformed archive containing crafted Mac metadata (AppleDouble) entries as a model artifact, dataset bundle, or notebook export to a shared AI platform. When a pipeline step, model registry operation, or user workflow extracts it with libarchive, the use-after-free is triggered. The component crashes, which disrupts the pipeline or serving workflow. With repeated attempts and favorable heap conditions, the attacker might also read stale memory contents. The high attack complexity and the need for a local, user-driven action keep the practical impact small.

Weaknesses (CWE)

CWE-416Use After Free

CWE-416 — Use After Free: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

[Architecture and Design] Choose a language that provides automatic memory management.
[Implementation] When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

Source: MITRE CWE corpus.