Medium severity · published Jun 9, 2025
CVE-2025-5918
A vulnerability has been identified in the libarchive library
6.6
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
6.0; 7.0; 8.0; 9.0 · source: NVD
LI
Libarchive · Libarchive
before 3.8.0 · source: NVD
OC
Openshift Container Platform · Redhat
4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-5918
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-5918
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-5918
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2370877
Patch
https://github.com/libarchive/libarchive/pull/2584
Release Notes
https://github.com/libarchive/libarchive/releases/tag/v3.8.0
More from Libarchive
9.8
CVE-2022-36227
In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a…
9.1
CVE-2024-37407
Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled
8.8
CVE-2020-9308
archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a…
8.8
CVE-2018-1000878
libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder -…
8.8
CVE-2018-1000877
libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder -…