CVE-2024-48958

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-10 · updated 2026-06-17
Weakness: CWE-125

Description

execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.

Affected products

libarchive: from 3.6.0 before 3.7.5 — fixed in 3.7.5

How to fix

Upgrade to a fixed version: libarchive 3.7.5. Check the vendor advisory for mitigations.

References

https://github.com/libarchive/libarchive/compare/v3.7.4...v3.7.5
https://github.com/libarchive/libarchive/pull/2148
https://github.com/terrynini/CVE-Reports/tree/main/CVE-2024-48958
http://seclists.org/fulldisclosure/2025/Apr/11
http://seclists.org/fulldisclosure/2025/Apr/12
http://seclists.org/fulldisclosure/2025/Apr/13
http://seclists.org/fulldisclosure/2025/Apr/4
http://seclists.org/fulldisclosure/2025/Apr/8

Get alerted when CVE-2024-48958 or the next vulnerability affects your stack