VulnerabilityModified

CVE-2025-5915

A vulnerability has been identified in the libarchive library.

MEDIUM 6.6EPSS 0.19%

Does this matter?

Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.

CVSS 3.1: 6.6 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
EPSS: 0.19% probability · 9th percentile
CISA KEV: Not listed
Weakness: CWE-122
Affected: libarchive/libarchive · redhat/openshift container platform · redhat/enterprise linux
Source: secalert@redhat.com

References

https://access.redhat.com/security/cve/CVE-2025-5915Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2370865Issue Tracking
https://github.com/libarchive/libarchive/pull/2599Patch
https://github.com/libarchive/libarchive/releases/tag/v3.8.0Release Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.