CVE-2026-4426
Redhat Enterprise Linux 10.0 … 9.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSummary
CVE-2026-4426 is a medium-severity Incorrect Bitwise Shift of Integer (CWE-1335) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13099
Vulnerability Data
A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially…
more
crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover incorrect shift operations through static analysis, dynamic testing, or fuzzing before deployment.
Requiring documented development standards and tools can enforce language rules and static checks that prohibit out-of-range or negative shift amounts.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent shift-related coding errors via reviews and analysis tools, but eliminating this single weakness only partially fulfills the broad control intent.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect shift-related defects before release.
Secure development life cycle includes practices that can catch or prevent undefined bitwise-shift behavior.
Application security requirements can mandate input validation and range checks that avoid invalid shift counts.
Secure system architecture and engineering principles encourage defensive coding that prevents undefined integer operations.
Secure coding directly addresses the use of safe bitwise-shift operations and bounds checking.