The flaw is a null pointer dereference in the ACL parsing function of libarchive. When a malformed ACL string such as a lone 'd' or 'default' tag is parsed, the code fails to validate the pointer before advancing, leading to a crash. An attacker can supply a specially crafted archive that triggers this behavior, causing any application that uses the libarchive API, for example bsdtar, to terminate. The result is a denial of service through application failure. This weakness is a classic null pointer dereference (CWE‑476).

The vulnerability affects libarchive installed on Red Hat Enterprise Linux releases 6 through 10, as well as Red Hat Hardened Images and Red Hat OpenShift Container Platform 4. Systems running these distributions or containers that incorporate the affected libarchive library are at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1 % suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to cause a malicious archive to be parsed by a vulnerable application, which can be achieved locally by any user owning a process that invokes libarchive, or remotely if the target runs a service that accepts untrusted archives. The lack of an available workaround and limited exploit evidence mean that the primary mitigation is to update to a patched version once released.