CVE-2026-5745

CVE-2026-5745 is a NULL pointer dereference vulnerability in libarchive's ACL parsing function (archive_acl_from_text_nl()) that occurs when processing malformed ACL strings lacking proper field validation. This flaw affects applications utilizing the libarchive API, including bsdtar and other archive extraction tools that rely on this library for parsing archive metadata. The vulnerability presents a medium severity risk (CVSS 5.5) with a local attack vector requiring user interaction to exploit. An attacker must trick a user into processing a specially crafted malicious archive file. While the attack complexity is low and no special privileges are needed, the impact is limited to availability, causing application crashes and denial of service rather than enabling data compromise or system compromise. There is currently no evidence of active exploitation in the wild, with an EPSS score of 0.000190 indicating minimal real-world exploitation likelihood. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains on inactive status in tracking lists. However, the moderate FAUCET risk score of 41.0/100 warrants timely patching, particularly for systems where libarchive is used to process untrusted archive files.