High severity · published Jun 9, 2025
CVE-2025-5914
Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c
7.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Compliance Operator 1 · Red Hat
All versions, or not specified · source: vendor
OF
OpenShift File Integrity Operator - FIO 1 · Red Hat
All versions, or not specified · source: vendor
RH
RHOSS-1.36-RHEL-8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Discovery 2 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.2 Advanced Update Support · Red Hat
All versions, or not specified · source: vendor
Affected product
CO
cert-manager operator for Red Hat OpenShift 1.16
Red Hat
More from cert-manager operator for Red Hat OpenShift 1.16
9.1
CVE-2025-49794
Libxml: heap use after free (uaf) leads to denial of service (dos)
9.1
CVE-2025-49796
Libxml: type confusion leads to denial of service (dos)
7.8
CVE-2025-7425
Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr
7.8
CVE-2025-6020
Linux-pam: linux-pam directory traversal