CVE-2026-4426: MLflow — MEDIUM

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago20% patched~68d to patchFull package profile →
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago20% patched~68d to patchFull package profile →
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago20% patched~68d to patchFull package profile →
libarchive	—	—	No patch
libarchive-main	—	—	No patch
openshift/ose-rhel-coreos-8	—	—	No patch
openshift/ose-rhel-coreos-9	—	—	No patch
rhoai/odh-ai-gateway-operator-rhel9	—	—	No patch
rhoai/odh-core-bff-rhel9	—	—	No patch
rhoai/odh-dashboard-operator-rhel9	—	—	No patch
rhoai/odh-dashboard-rhel9	—	—	No patch
rhoai/odh-data-science-pipelines-operator-controller-rhel9	—	—	No patch
rhoai/odh-kf-notebook-controller-rhel9	—	—	No patch
rhoai/odh-kserve-controller-rhel9	—	—	No patch
rhoai/odh-kserve-llmisvc-controller-rhel9	—	—	No patch
rhoai/odh-kserve-module-operator-rhel9	—	—	No patch
rhoai/odh-kube-rbac-proxy-rhel9	—	—	No patch
rhoai/odh-kuberay-operator-controller-rhel9	—	—	No patch
rhoai/odh-llama-stack-k8s-operator-rhel9	—	—	No patch
rhoai/odh-maas-controller-rhel9	—	—	No patch
rhoai/odh-mod-arch-agent-ops-rhel9	—	—	No patch
rhoai/odh-mod-arch-automl-rhel9	—	—	No patch
rhoai/odh-mod-arch-autorag-rhel9	—	—	No patch
rhoai/odh-mod-arch-eval-hub-rhel9	—	—	No patch
rhoai/odh-mod-arch-gen-ai-rhel9	—	—	No patch
rhoai/odh-mod-arch-maas-rhel9	—	—	No patch
rhoai/odh-mod-arch-model-registry-rhel9	—	—	No patch
rhoai/odh-model-controller-rhel9	—	—	No patch
rhoai/odh-model-registry-operator-rhel9	—	—	No patch
rhoai/odh-model-serving-api-rhel9	—	—	No patch
rhoai/odh-notebook-controller-rhel9	—	—	No patch
rhoai/odh-ogx-k8s-operator-rhel9	—	—	No patch
rhoai/odh-ogx-module-operator-rhel9	—	—	No patch
rhoai/odh-training-operator-rhel9	—	—	No patch
rhoai/odh-trustyai-service-operator-rhel9	—	—	No patch
rhoai/odh-workbenches-operator-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CNone

INone

AHigh

What should I do?

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-4426?

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.

Is CVE-2026-4426 actively exploited?

No confirmed active exploitation of CVE-2026-4426 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-4426?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2026-4426?

CVE-2026-4426 has a CVSS v3.1 base score of 6.5 (MEDIUM).

What are the technical details?

Original Advisory

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.

Weaknesses (CWE)

CWE-1335Incorrect Bitwise Shift of Integer

CWE-1335 — Incorrect Bitwise Shift of Integer: An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value.