BaseFortify

Publication date: 2025-11-05

Last updated on: 2026-02-04

Assigner: MITRE

Description

An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-05

Last Modified

2026-02-04

Generated

2026-07-06

AI Q&A

2025-11-05

EPSS Evaluated

2026-07-05

NVD

CVE-2025-60753

EUVD

EUVD-2025-37900

Affected Vendors & Products

Vendor	Product	Version / Range
libarchive	bsdtar	*
libarchive	libarchive	to 3.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability exists in libarchive bsdtar before version 3.8.1 in the apply_substitution function when processing crafted -s substitution rules. It can cause unbounded memory allocation, which may lead to a denial of service through an Out-of-Memory crash.

Impact Analysis

The vulnerability can cause the affected application to consume excessive memory, potentially crashing the system or service due to an Out-of-Memory condition, resulting in denial of service.

Hi! I’m here to help you understand CVE-2025-60753. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70