Description
list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
References (3)
Scores
CVSS v3
4.0
EPSS
0.0003
EPSS Percentile
8.0%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-252
Status
published
Products (1)
libarchive/libarchive
< 3.7.7
Published
Mar 02, 2025
Tracked Since
Feb 18, 2026