A flaw in libarchive’s zisofs decompression logic allows a specially crafted ISO9660 file to trigger undefined behavior. When the bad ‘pz_log2_bs’ field is read, libarchive can allocate an incorrect amount of memory, causing the application that uses libarchive to crash. The crash results in a denial‑of‑service condition for any process that attempts to read the file. This weakness is classified as CWE‑1335.

The vulnerability affects Red Hat Enterprise Linux 10, 6, 7, 8, and 9, as well as Red Hat Hardened Images and Red Hat OpenShift Container Platform 4. The affected component is the libarchive library bundled with these distributions. No specific version ranges are listed, so any deployment of libarchive on these systems remains potentially vulnerable until an official fix is released.

With a CVSS score of 6.5, the severity is moderate, and an EPSS score of less than 1 % indicates that active exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious ISO file that a user or service processes through libarchive. Because the attack vector is through local or potentially remote file handling, administrators should restrict exposure by controlling which ISO images are processed and by keeping the library up to date once a patch is available.