Vulnerability-Lookup

CVE-2025-5918 (GCVE-0-2025-5918)

Vulnerability from cvelistv5 – Published: 2025-06-09 19:49 – Updated: 2026-09-01 12:08

Title

Libarchive: reading past eof may be triggered for piped file streams

Summary

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.

Severity

3.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-10 13:44 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

redhat redhat root

References

4 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2025-5918	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2370877	issue-trackingx_refsource_REDHAT
https://github.com/libarchive/libarchive/pull/2584
https://github.com/libarchive/libarchive/releases…

Impacted products

7 products

Vendor	Product	Version
		Affected: 0 , < 3.8.0 (semver)
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2025-05-20 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-5918",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-10T13:44:05.687379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-10T14:06:30.905Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/libarchive/libarchive/",
          "defaultStatus": "unaffected",
          "packageName": "libarchive",
          "versions": [
            {
              "lessThan": "3.8.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libarchive",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-05-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T12:08:20.689Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-5918"
        },
        {
          "name": "RHBZ#2370877",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370877"
        },
        {
          "url": "https://github.com/libarchive/libarchive/pull/2584"
        },
        {
          "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-06-06T19:27:09.090Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-05-20T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libarchive: reading past eof may be triggered for piped file streams",
      "workarounds": [
        {
          "lang": "en",
          "value": "Upgrade to libarchive version 3.8.0 or later, which includes important security fixes and stability improvements."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-5918",
    "datePublished": "2025-06-09T19:49:13.544Z",
    "dateReserved": "2025-06-09T08:11:22.154Z",
    "dateUpdated": "2026-09-01T12:08:20.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-5918",
      "date": "2026-09-15",
      "epss": "0.00368",
      "percentile": "0.30253"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:43:28.000Z",
      "cve": "CVE-2025-5918",
      "id": "msrc_CVE-2025-5918",
      "initial_release_date": "2025-06-02T00:00:00.000Z",
      "product_status:fixed": "7",
      "product_status:known_affected": "8",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Libarchive: reading past eof may be triggered for piped file streams",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-5918.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-5918\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2025-06-09T20:15:27.493\",\"lastModified\":\"2026-09-01T13:17:47.933\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en la librer\u00eda libarchive. Esta falla puede activarse cuando se canalizan flujos de archivos a bsdtar, lo que podr\u00eda permitir la lectura m\u00e1s all\u00e1 del final del archivo. Esta lectura fuera de los l\u00edmites puede tener consecuencias imprevistas, como un comportamiento impredecible del programa, corrupci\u00f3n de memoria o una condici\u00f3n de denegaci\u00f3n de servicio.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com/libarchive/libarchive/\",\"packageName\":\"libarchive\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"3.8.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libarchive\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libarchive\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libarchive\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libarchive\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libarchive\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift/ose-rhel-coreos-8\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift/ose-rhel-coreos-9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L\",\"baseScore\":3.9,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.3,\"impactScore\":2.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.3,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-06-10T13:44:05.687379Z\",\"id\":\"CVE-2025-5918\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.8.0\",\"matchCriteriaId\":\"FCC41392-D22A-4BE5-B7E7-DE5D6BA40052\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"932D137F-528B-4526-9A89-CD59FA1AB0FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"142AD0DD-4CF3-4D74-9442-459CE3347E3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F6FB57C-2BC7-487C-96DD-132683AEB35D\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2025-5918\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2370877\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://github.com/libarchive/libarchive/pull/2584\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/libarchive/libarchive/releases/tag/v3.8.0\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Release Notes\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-01T12:08:16+00:00",
      "cve": "CVE-2025-5918",
      "id": "CVE-2025-5918",
      "initial_release_date": "2025-05-20T00:00:00+00:00",
      "product_status:known_affected": "22",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "libarchive: Reading past EOF may be triggered for piped file streams",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5918.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-01T01:06:01Z",
      "cve": "CVE-2025-5918",
      "id": "CVE-2025-5918",
      "initial_release_date": "2025-06-10T02:18:29Z",
      "product_status:known_affected": "503",
      "product_status:known_not_affected": "63",
      "product_status:recommended": "70",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-5918",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-5918.json",
      "version": "33"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-5918\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-10T13:44:05.687379Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-10T14:06:28.595Z\"}}], \"cna\": {\"title\": \"Libarchive: reading past eof may be triggered for piped file streams\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Low\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.9, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.8.0\", \"versionType\": \"semver\"}], \"packageName\": \"libarchive\", \"collectionURL\": \"https://github.com/libarchive/libarchive/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"libarchive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"libarchive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"libarchive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"libarchive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"libarchive\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift/ose-rhel-coreos-8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift/ose-rhel-coreos-9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-06-06T19:27:09.090Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2025-05-20T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2025-05-20T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2025-5918\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2370877\", \"name\": \"RHBZ#2370877\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://github.com/libarchive/libarchive/pull/2584\"}, {\"url\": \"https://github.com/libarchive/libarchive/releases/tag/v3.8.0\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Upgrade to libarchive version 3.8.0 or later, which includes important security fixes and stability improvements.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-09-01T12:08:20.689Z\"}, \"x_redhatCweChain\": \"CWE-125: Out-of-bounds Read\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-5918\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-01T12:08:20.689Z\", \"dateReserved\": \"2025-06-09T08:11:22.154Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2025-06-09T19:49:13.544Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-3HQH-8H99-Q2CF

Vulnerability from github – Published: 2025-06-09 21:30 – Updated: 2025-06-09 21:30

Details

Severity

3.9 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-5918"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-09T20:15:27Z",
    "severity": "LOW"
  },
  "details": "A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.",
  "id": "GHSA-3hqh-8h99-q2cf",
  "modified": "2025-06-09T21:30:52Z",
  "published": "2025-06-09T21:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5918"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libarchive/libarchive/pull/2584"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-5918"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370877"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2025-5918

Vulnerability from csaf_microsoft - Published: 2025-06-02 00:00 - Updated: 2026-02-18 14:43

Summary

Libarchive: reading past eof may be triggered for piped file streams

Scope

1 vulnerability in this advisory, including CVE-2025-5918.

CVE-2025-5918

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

Fixed: 7 products Known affected: 8 products

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

NCSC-2025-0396

Vulnerability from csaf_ncscnl - Published: 2025-12-15 09:06 - Updated: 2025-12-15 09:06

Summary

Kwetsbaarheden verholpen in Apple macOS

Scope

49 vulnerabilities in this advisory, including CVE-2025-5918.

CVE-2025-5918

The libarchive library update addresses multiple vulnerabilities, including integer overflows and heap buffer over reads, with a specific issue allowing reading past EOF in piped file streams, affecting Apple Software.

6.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Known affected: 3 products

Open the full advisory

NCSC-2025-0397

Vulnerability from csaf_ncscnl - Published: 2025-12-15 09:08 - Updated: 2025-12-15 09:08

Summary

Kwetsbaarheden verholpen in Apple iOS en iPadOS

Scope

28 vulnerabilities in this advisory, including CVE-2025-5918.

CVE-2025-5918

6.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Known affected: 1 product

Open the full advisory

SUSE-SU-2025:02566-1

Vulnerability from csaf_suse - Published: 2025-07-31 07:18 - Updated: 2025-07-31 07:18

Summary

Security update for libarchive

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2025-5918.

CVE-2025-5918

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

Recommended: 37 products

Open the full advisory

SUSE-SU-2025:02718-1

Vulnerability from csaf_suse - Published: 2025-08-06 13:55 - Updated: 2025-08-06 13:55

Summary

Security update for libarchive

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2025-5918.

CVE-2025-5918

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

Recommended: 10 products

Open the full advisory

SUSE-SU-2025:02718-2

Vulnerability from csaf_suse - Published: 2025-08-20 09:46 - Updated: 2025-08-20 09:46

Summary

Security update for libarchive

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2025-5918.

CVE-2025-5918

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

Recommended: 68 products

Open the full advisory

SUSE-SU-2025:20560-1

Vulnerability from csaf_suse - Published: 2025-08-20 11:38 - Updated: 2025-08-20 11:38

Summary

Security update for libarchive

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2025-5918.

CVE-2025-5918

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

Recommended: 3 products

Open the full advisory

SUSE-SU-2025:20594-1

Vulnerability from csaf_suse - Published: 2025-08-14 10:12 - Updated: 2025-08-14 10:12

Summary

Security update for libarchive

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2025-5918.

CVE-2025-5918

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

Recommended: 4 products

Open the full advisory

ubuntu-cve-2025-5918

Vulnerability from osv_ubuntu

Published

2025-06-09 20:15

Modified

2026-04-22 07:53

Summary

Details

Severity

3.9 (Low)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

6.6 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2025-5918	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-5918	REPORT
	https://github.com/libarchive/libarchive/pull/2584	REPORT
	https://access.redhat.com/security/cve/CVE-2025-5918	REPORT
	https://github.com/libarchive/libarchive/releases…	REPORT
	https://ubuntu.com/security/notices/USN-8147-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "bsdcpio",
            "binary_version": "3.1.2-7ubuntu2.8+esm4"
          },
          {
            "binary_name": "bsdtar",
            "binary_version": "3.1.2-7ubuntu2.8+esm4"
          },
          {
            "binary_name": "libarchive13",
            "binary_version": "3.1.2-7ubuntu2.8+esm4"
          }
        ],
        "priority_reason": "Denial of service in a command-line tool"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "libarchive",
        "purl": "pkg:deb/ubuntu/libarchive@3.1.2-7ubuntu2.8+esm4?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.2-7ubuntu2.8+esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2-5ubuntu1",
        "3.1.2-7ubuntu1",
        "3.1.2-7ubuntu2",
        "3.1.2-7ubuntu2.1",
        "3.1.2-7ubuntu2.2",
        "3.1.2-7ubuntu2.3",
        "3.1.2-7ubuntu2.4",
        "3.1.2-7ubuntu2.6",
        "3.1.2-7ubuntu2.7",
        "3.1.2-7ubuntu2.8",
        "3.1.2-7ubuntu2.8+esm1",
        "3.1.2-7ubuntu2.8+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "bsdcpio",
            "binary_version": "3.1.2-11ubuntu0.16.04.8+esm2"
          },
          {
            "binary_name": "bsdtar",
            "binary_version": "3.1.2-11ubuntu0.16.04.8+esm2"
          },
          {
            "binary_name": "libarchive13",
            "binary_version": "3.1.2-11ubuntu0.16.04.8+esm2"
          }
        ],
        "priority_reason": "Denial of service in a command-line tool"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "libarchive",
        "purl": "pkg:deb/ubuntu/libarchive@3.1.2-11ubuntu0.16.04.8+esm2?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.2-11ubuntu0.16.04.8+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.2-11build1",
        "3.1.2-11ubuntu0.16.04.1",
        "3.1.2-11ubuntu0.16.04.2",
        "3.1.2-11ubuntu0.16.04.3",
        "3.1.2-11ubuntu0.16.04.4",
        "3.1.2-11ubuntu0.16.04.5",
        "3.1.2-11ubuntu0.16.04.6",
        "3.1.2-11ubuntu0.16.04.7",
        "3.1.2-11ubuntu0.16.04.8",
        "3.1.2-11ubuntu0.16.04.8+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "bsdcpio",
            "binary_version": "3.2.2-3.1ubuntu0.7+esm2"
          },
          {
            "binary_name": "bsdtar",
            "binary_version": "3.2.2-3.1ubuntu0.7+esm2"
          },
          {
            "binary_name": "libarchive-tools",
            "binary_version": "3.2.2-3.1ubuntu0.7+esm2"
          },
          {
            "binary_name": "libarchive13",
            "binary_version": "3.2.2-3.1ubuntu0.7+esm2"
          }
        ],
        "priority_reason": "Denial of service in a command-line tool"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "libarchive",
        "purl": "pkg:deb/ubuntu/libarchive@3.2.2-3.1ubuntu0.7+esm2?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.2-3.1ubuntu0.7+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.2.2-3.1",
        "3.2.2-3.1ubuntu0.1",
        "3.2.2-3.1ubuntu0.2",
        "3.2.2-3.1ubuntu0.3",
        "3.2.2-3.1ubuntu0.4",
        "3.2.2-3.1ubuntu0.5",
        "3.2.2-3.1ubuntu0.6",
        "3.2.2-3.1ubuntu0.7",
        "3.2.2-3.1ubuntu0.7+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libarchive-tools",
            "binary_version": "3.4.0-2ubuntu1.5+esm1"
          },
          {
            "binary_name": "libarchive13",
            "binary_version": "3.4.0-2ubuntu1.5+esm1"
          }
        ],
        "priority_reason": "Denial of service in a command-line tool"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "libarchive",
        "purl": "pkg:deb/ubuntu/libarchive@3.4.0-2ubuntu1.5+esm1?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.0-2ubuntu1.5+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.4.0-1",
        "3.4.0-1build1",
        "3.4.0-1ubuntu2",
        "3.4.0-2ubuntu1",
        "3.4.0-2ubuntu1.1",
        "3.4.0-2ubuntu1.2",
        "3.4.0-2ubuntu1.3",
        "3.4.0-2ubuntu1.4",
        "3.4.0-2ubuntu1.5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libarchive-tools",
            "binary_version": "3.6.0-1ubuntu1.6"
          },
          {
            "binary_name": "libarchive13",
            "binary_version": "3.6.0-1ubuntu1.6"
          }
        ],
        "priority_reason": "Denial of service in a command-line tool"
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "libarchive",
        "purl": "pkg:deb/ubuntu/libarchive@3.6.0-1ubuntu1.6?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.0-1ubuntu1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.4.3-2",
        "3.4.3-2build1",
        "3.5.2-1",
        "3.5.2-1ubuntu1",
        "3.6.0-1ubuntu1",
        "3.6.0-1ubuntu1.1",
        "3.6.0-1ubuntu1.2",
        "3.6.0-1ubuntu1.3",
        "3.6.0-1ubuntu1.4",
        "3.6.0-1ubuntu1.5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libarchive-tools",
            "binary_version": "3.7.2-2ubuntu0.6"
          },
          {
            "binary_name": "libarchive13t64",
            "binary_version": "3.7.2-2ubuntu0.6"
          }
        ],
        "priority_reason": "Denial of service in a command-line tool"
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "libarchive",
        "purl": "pkg:deb/ubuntu/libarchive@3.7.2-2ubuntu0.6?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.2-2ubuntu0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.6.2-1ubuntu1",
        "3.7.2-1ubuntu1",
        "3.7.2-1ubuntu2",
        "3.7.2-1.1ubuntu2",
        "3.7.2-2",
        "3.7.2-2ubuntu0.1",
        "3.7.2-2ubuntu0.2",
        "3.7.2-2ubuntu0.3",
        "3.7.2-2ubuntu0.4",
        "3.7.2-2ubuntu0.5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libarchive-tools",
            "binary_version": "3.7.7-0ubuntu3.1"
          },
          {
            "binary_name": "libarchive13t64",
            "binary_version": "3.7.7-0ubuntu3.1"
          }
        ],
        "priority_reason": "Denial of service in a command-line tool"
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "libarchive",
        "purl": "pkg:deb/ubuntu/libarchive@3.7.7-0ubuntu3.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.7-0ubuntu3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.7.7-0ubuntu2",
        "3.7.7-0ubuntu2.1",
        "3.7.7-0ubuntu2.2",
        "3.7.7-0ubuntu3"
      ]
    }
  ],
  "aliases": [],
  "details": "A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.",
  "id": "UBUNTU-CVE-2025-5918",
  "modified": "2026-04-22T07:53:18Z",
  "published": "2025-06-09T20:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-5918"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-5918"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/libarchive/libarchive/pull/2584"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-5918"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8147-1"
    }
  ],
  "related": [
    "USN-8147-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-5918"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-5918 (GCVE-0-2025-5918)

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature