CVE-2025-5915
BaseFortify
Publication date: 2025-06-09
Last updated on: 2025-08-25
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libarchive | libarchive | to 3.8.0 (exc) |
| redhat | openshift_container_platform | 4.0 |
| redhat | enterprise_linux | 6.0 |
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux | 10.0 |
| redhat | enterprise_linux | 8.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can cause your programs using libarchive to behave unpredictably or crash (denial of service) when processing malicious RAR archives. Additionally, it may lead to the disclosure of sensitive information from memory adjacent to the buffer being read, potentially exposing data unintentionally. [1, 2]
Can you explain this vulnerability to me?
CVE-2025-5915 is a heap buffer over-read vulnerability in the libarchive library's RAR decompression code. It occurs because the size of a filter block can exceed the size of the LZSS (Lempel-Ziv-Storer-Szymanski) window used during decompression. This causes the library to read beyond the allocated heap buffer, leading to unpredictable program behavior, crashes, or potential disclosure of sensitive information from adjacent memory. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability occurs during decompression of RAR archives using vulnerable libarchive versions prior to 3.8.0. Detection can involve checking the libarchive version installed on your system to see if it is older than 3.8.0. You can use commands like `ldd --version` or check package manager info (e.g., `rpm -q libarchive` on Red Hat-based systems or `dpkg -s libarchive` on Debian-based systems). Additionally, monitoring logs for crashes or errors related to RAR decompression may help identify exploitation attempts. There are no specific network detection commands provided for this vulnerability. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update libarchive to version 3.8.0 or later, where the issue has been fixed. The fix includes validation to reject filter blocks larger than the LZSS window and corrected copy logic to prevent heap buffer over-reads. Avoid processing untrusted RAR archives with vulnerable libarchive versions until patched. Monitoring for updates and applying patches promptly is recommended. [1, 2]