The vulnerability is a classic double‑free bug in libarchive's RAR5 reader. During unpacking state reinitialization, the filtered_buf pointer can be left pointing to freed memory. When the next archive entry is processed, a second free on the same region can occur, causing a double‑free condition. An attacker who can supply a crafted RAR5 archive may trigger this and cause the host application to crash or terminate unexpectedly, resulting in a denial of service.

Affected vendors include Red Hat Enterprise Linux 10, 6, 7, 8, 9, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. No specific version numbers are listed, so any installation that includes the vulnerable libarchive package may be impacted as long as RAR5 support is present.

The CVSS score of 7.5 indicates a high severity. EPSS is not available, but the double‑free can be exploited if an attacker can feed a malicious file to the application. Since the vulnerability is not in CISA’s KEV catalog, no known exploits have been publicly reported yet. The risk is moderate‑high, especially for services that parse user‑supplied archives or run with elevated privileges.