The vulnerability is an integer overflow in libarchive’s ISO9660 zisofs block pointer allocation logic. Processing a specially crafted ISO image can trigger a heap buffer overflow, allowing an attacker to execute arbitrary code with the privileges of the process that uses libarchive. This weakness is classified as CWE‑190 and can lead to complete compromise of the affected system.

Affected systems include Red Hat Enterprise Linux distributions 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4—all of which ship libarchive. The flaw is limited to 32‑bit builds and impacts any component that extracts ISO9660 images, such as the default container runtime and related tooling.

The CVSS score of 7.5 indicates high severity, yet the EPSS score is below 1 %, showing rare exploitation evidence. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an application to process a malicious ISO image; thus, the attack vector is primarily through supply of untrusted ISO files, either locally or over a network service that extracts them. No additional conditions are noted beyond the use of libarchive on a 32‑bit system.