What’s Vulnerable › Vulnerabilities

CVE-2025-5915: Libarchive: heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c

• Severity: medium (CVSS 6.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-09 · updated 2026-09-01
• Weakness: CWE-122

Description

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.

Affected products

• libarchive: before 3.8.0 — fixed in 3.8.0
• Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0, 10.0
• Red Hat OpenShift Container Platform 4.18: 4.0

How to fix

Upgrade to a fixed version: libarchive 3.8.0. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/security/cve/CVE-2025-5915
• https://bugzilla.redhat.com/show_bug.cgi?id=2370865
• https://github.com/libarchive/libarchive/pull/2599
• https://github.com/libarchive/libarchive/releases/tag/v3.8.0

Get alerted when CVE-2025-5915 or the next vulnerability affects your stack