CVE-2025-5914

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-5914
A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

3.9 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2025-5914 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2370861 Issue Tracking Third Party Advisory
https://github.com/libarchive/libarchive/pull/2598 Exploit Issue Tracking Patch
https://github.com/libarchive/libarchive/releases/tag/v3.8.0 Release Notes
https://github.com/libarchive/libarchive/pull/2598 Exploit Issue Tracking Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
History

20 Jun 2025, 14:49

Type Values Removed Values Added
References () https://access.redhat.com/security/cve/CVE-2025-5914 - () https://access.redhat.com/security/cve/CVE-2025-5914 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2370861 - () https://bugzilla.redhat.com/show_bug.cgi?id=2370861 - Issue Tracking, Third Party Advisory
References () https://github.com/libarchive/libarchive/pull/2598 - () https://github.com/libarchive/libarchive/pull/2598 - Exploit, Issue Tracking, Patch
References () https://github.com/libarchive/libarchive/releases/tag/v3.8.0 - () https://github.com/libarchive/libarchive/releases/tag/v3.8.0 - Release Notes
CPE cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
First Time Redhat openshift Container Platform
Libarchive
Redhat
Libarchive libarchive
Redhat enterprise Linux

10 Jun 2025, 16:15

Type Values Removed Values Added
References () https://github.com/libarchive/libarchive/pull/2598 - () https://github.com/libarchive/libarchive/pull/2598 -
Summary
  • (es) Se ha identificado una vulnerabilidad en la librería libarchive, específicamente en la función archive_read_format_rar_seek_data(). Esta falla implica un desbordamiento de enteros que puede provocar una condición de doble liberación. Explotar una vulnerabilidad de doble liberación puede provocar corrupción de memoria, lo que permite a un atacante ejecutar código arbitrario o causar una denegación de servicio.

09 Jun 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-09 20:15

Updated : 2025-06-20 14:49

NVD link : CVE-2025-5914

Mitre link : CVE-2025-5914

CVE.ORG link : CVE-2025-5914

JSON object : View

Products Affected

redhat

  • openshift_container_platform
  • enterprise_linux

libarchive

  • libarchive
CWE
CWE-415

Double Free