Log in Start free

Vulnerability · Published Jun 9, 2025 · Assigned by redhat

CVE-2025-5914Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

High 7.8

In plain English

A high-severity integer overflow in libarchive. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.5%top 57.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10bsdtar3.7.7-4.el10_0ALSA-2025:14137
AlmaLinux:8bsdtar3.3.3-6.el8_10ALSA-2025:14135
AlmaLinux:9bsdtar3.5.3-6.el9_6ALSA-2025:14130
AlmaLinux:10libarchive3.7.7-4.el10_0ALSA-2025:14137
AlmaLinux:8libarchive3.3.3-6.el8_10ALSA-2025:14135
AlmaLinux:9libarchive3.5.3-6.el9_6ALSA-2025:14130
AlmaLinux:10libarchive-devel3.7.7-4.el10_0ALSA-2025:14137
AlmaLinux:8libarchive-devel3.3.3-6.el8_10ALSA-2025:14135
AlmaLinux:9libarchive-devel3.5.3-6.el9_6ALSA-2025:14130
Debian:12libarchive3.6.2-1+deb12u3DEBIAN-CVE-2025-5914
Debian:13libarchive3.7.4-4DEBIAN-CVE-2025-5914
Debian:14libarchive3.7.4-4DEBIAN-CVE-2025-5914
Rocky Linux:10libarchive0:3.7.7-4.el10_0RLSA-2025:14137
Rocky Linux:8libarchive0:3.3.3-6.el8_10RLSA-2025:14135
Rocky Linux:9libarchive0:3.5.3-6.el9_6RLSA-2025:14130
Ubuntu:22.04:LTSlibarchive3.6.0-1ubuntu1.5USN-7601-1
Ubuntu:22.04:LTSlibarchive3.6.0-1ubuntu1.5UBUNTU-CVE-2025-5914
Ubuntu:24.04:LTSlibarchive3.7.2-2ubuntu0.5USN-7601-1
Ubuntu:24.04:LTSlibarchive3.7.2-2ubuntu0.5UBUNTU-CVE-2025-5914
Ubuntu:25.10libarchive3.7.7-0ubuntu3UBUNTU-CVE-2025-5914

Affected products (as reported)

VendorProductVersions
libarchive 0 – before 3.8.0
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support see references
Red Hat Red Hat OpenShift Container Platform 4.14 see references
Red Hat Red Hat OpenShift Container Platform 4.15 see references
Red Hat Red Hat OpenShift Container Platform 4.16 see references
Red Hat Red Hat OpenShift Container Platform 4.17 see references
Red Hat Red Hat OpenShift Container Platform 4.18 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.20 see references
Red Hat Red Hat Web Terminal 1.11 on RHEL 9 see references
Red Hat Red Hat Web Terminal 1.11 on RHEL 9 see references
Red Hat Red Hat Web Terminal 1.12 on RHEL 9 see references
Red Hat RHOSS-1.36-RHEL-8 see references
Red Hat RHOSS-1.36-RHEL-8 see references
Red Hat RHOSS-1.36-RHEL-8 see references

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References