Hi,

The following vulnerability was published for libarchive.

CVE-2026-15028[0]:
| A flaw was found in libarchive. This vulnerability allows a remote
| attacker to trigger a heap overflow by providing a specially crafted
| tar archive. The issue occurs during the parsing of a PAX extended
| header containing a malformed SUN.holesdata sparse-file attribute.
| Successful exploitation could lead to a denial of service, making
| the system unavailable, or potentially allow for arbitrary code
| execution, giving the attacker control over the affected system.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-15028
https://www.cve.org/CVERecord?id=CVE-2026-15028
[1] https://github.com/libarchive/libarchive/issues/3251
[2] https://github.com/libarchive/libarchive/pull/3253
[3] https://github.com/libarchive/libarchive/commit/c16162083a247efd4a2bc71401489bec3090ae7c

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore