CVE-2025-5914: Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-06-09 · updated 2026-10-12
Weakness: CWE-190

Description

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

Affected products

libarchive: before 3.8.0 — fixed in 3.8.0
Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0, 10.0
Red Hat OpenShift Container Platform 4.18: 4.0

How to fix

Upgrade to a fixed version: libarchive 3.8.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-5914 or the next vulnerability affects your stack