VulnerabilityAnalyzed

CVE-2025-5918

A vulnerability has been identified in the libarchive library.

MEDIUM 6.6EPSS 0.37%

Does this matter?

Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.

CVSS 3.1: 6.6 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
EPSS: 0.37% probability · 30th percentile
CISA KEV: Not listed
Weakness: CWE-125
Affected: libarchive/libarchive · redhat/openshift container platform · redhat/enterprise linux
Source: secalert@redhat.com

References

https://access.redhat.com/security/cve/CVE-2025-5918Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2370877Issue Tracking
https://github.com/libarchive/libarchive/pull/2584Patch
https://github.com/libarchive/libarchive/releases/tag/v3.8.0Release Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.