CVE-2025-5915

MEDIUM

Libarchive: heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-5915 has a selected CVSS score of 6.6 (medium); EIP currently links 1 repository PoC.

Description

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 10, 2025 · Source: CVE List

Affected products and versions

7
ProductSourceVersion range

Red Hat Enterprise Linux 10

Browse Red Hat / Red Hat Enterprise Linux 10libarchive

Default status: affected

CVE ListVersion data not supplied

Red Hat Enterprise Linux 6

Browse Red Hat / Red Hat Enterprise Linux 6libarchive

Default status: unknown

CVE ListVersion data not supplied

Red Hat Enterprise Linux 7

Browse Red Hat / Red Hat Enterprise Linux 7libarchive

Default status: unknown

CVE ListVersion data not supplied

Red Hat Enterprise Linux 8

Browse Red Hat / Red Hat Enterprise Linux 8libarchive

Default status: affected

CVE ListVersion data not supplied

Red Hat Enterprise Linux 9

Browse Red Hat / Red Hat Enterprise Linux 9libarchive

Default status: affected

CVE ListVersion data not supplied

Red Hat OpenShift Container Platform 4

Browse Red Hat / Red Hat OpenShift Container Platform 4rhcos

Default status: affected

CVE ListVersion data not supplied

libarchive

Default status: unaffected

CVE ListBefore 3.8.0affected

Proofs of concept

1

Repository PoCs

GitHubR3n3r0/cve-2025-5915Repository PoCby R3n3r00Exploit55 files

1.1 MiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a comprehensive exploit for payload withheld, a heap buffer over-read in libarchive's RAR v4 filter path. It includes a from-scratch RAR v4 encoder (build_encoder.py) that crafts archives to trigger the vulnerability, a script to modify existing archives (build_bigleak.py), a macOS interpose library (plant.c) to demonstrate memory disclosure, and an iOS application (RARLeak) that uses the system's vulnerable libarchive to exfiltrate heap memory on a real device. The primary operation is exercising the vulnerability to achieve controlled memory disclosure.

Backdoor review

No backdoor observed in reviewed code

The repository is a proof-of-concept (PoC) for payload withheld, a heap buffer over-read in libarchive. The supplied text files (README.md, writeup/payload withheld.en.md, writeup/payload withheld.it.md) describe the vulnerability, the methodology for reproducing it, and the analysis of the fix. They contain no instructions or code that would perform backdoor or deceptive actions against the person running the PoC. The described behavior (crafting RAR archives to trigger an over-read, using an iOS app to demonstrate the leak) is consistent with the stated goal of demonstrating the CVE. The binary files (RAR archives, compiled output, iOS project) are flagged as uninspected, but the text documentation provides no indication of concealed malicious payloads.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonCObjective-CMarkdown
Target softwarelibarchive
Attack typesheap buffer over-readinformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains multiple components that actively exercise the vulnerability to cause a heap over-read and exfiltrate memory, which is the definition of an exploit. The build_encoder.py script generates a malicious RAR archive from scratch to trigger the bug. The plant.c code and RARLeak iOS app are designed to demonstrate and measure the resulting memory disclosure. The writeup files are extensive technical analysis, but the presence of functional exploit code (the encoder, the interpose library, the iOS app) makes the primary classification 'exploit'.

README.md:3-6README.md:35-37writeup/cve-2025-5915.en.md:260-262writeup/cve-2025-5915.en.md:434-439

Requirements

  • A vulnerable version of libarchive (<= 3.7.9) must be used to process the crafted RAR archive.README.md:3-6writeup/cve-2025-5915.en.md:29-30
  • The attacker must be able to supply a crafted RAR v4 archive to the vulnerable libarchive instance.README.md:44-50

Observed behavior

  • Crafts a RAR v4 archive with a small declared uncompressed size (e.g., 16 bytes) to force a tiny LZSS window (32 bytes) and a large filter blocklength (e.g., 0x3C000) to trigger a heap over-read of up to ~240 KB.writeup/cve-2025-5915.en.md:260-277
  • Demonstrates that the out-of-bounds bytes read from the heap are included in the decompressed output, achieving memory disclosure.writeup/cve-2025-5915.en.md:223-254
  • On iOS 18.5, the provided app (RARLeak) dlopens the system libarchive, feeds it a crafted archive, and recovers ~150 KB of its own heap markers in the output, proving the vulnerability on a real device.writeup/cve-2025-5915.en.md:434-449
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability
Payload withheldThe entire repository is a PoC for this libarchive heap over-read vulnerability.README.md:1
File
Payload withheldPython script to generate a malicious RAR v4 archive that triggers the over-read. This is the core of the PoC and is expected behavior.README.md:36
File
Payload withheldAn iOS Xcode project that demonstrates the vulnerability on a real device by using the system's libarchive. This is part of the documented PoC.README.md:39
Review boundaries

What the analysis did not establish

  • The evidence packet includes 12 binary files (RAR archives, a binary payload) that were not analyzed; their content is only known from metadata and the writeup's description.
  • The analysis is based solely on the provided text files (README.md, writeup files); the actual exploit code (Python, C, Objective-C) is not included in the text evidence, so its exact implementation cannot be verified from the supplied lines.
  • The classification relies on the writeup's claims about the behavior of the code, as the code itself was not executed or inspected beyond the text descriptions.
  • 12 binary files (RAR archives, compiled output, iOS project) were not analyzed and are flagged as BINARY. Their contents could not be reviewed for backdoors.
  • 40 other text files in the repository were omitted from the evidence packet and were not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Research & analysis

1
Technical blogPaolo RussoSource: EIP research review

The version number lies

The blog demonstrates through binary patch-diffing that Apple silently backported the CVE-2025-5915 heap-buffer-overflow fix from libarchive 3.8.0 into iOS 18.6's libarchive 3.7.4 fork without updating the version string. iOS 18.5 (build 22F76) ships libarchive 3.7.4 without the fix and is vulnerable to a controlled heap over-read of up to ~256 KB via a crafted RAR v4 archive. The root cause is an unchecked blocklength in parse_filter() that allows a RAR-VM filter to request more bytes from the LZSS window than were allocated, leading to out-of-bounds heap read in copy_from_lzss_window(). The same memcpy also had a write-side overflow (CVE-2024-26256) that Apple had already backported into iOS 18.5. The author provides on-device proof on an iPhone 14 running iOS 18.5, demonstrating ~150 KB of heap disclosure through the system libarchive. The article also documents a second independent bug in the same function: a wrap-around memcpy destination error fixed in the same commit.

Root causeTechnical detailPoC research
https://blog.chess-set.eu/en/posts/the-version-number-lies
Research notes
  • Root cause
    The vulnerability is an unchecked blocklength in parse_filter() that allows a RAR-VM filter to request more bytes from the LZSS window than were allocated via unp_size, leading to an out-of-bounds heap read in copy_from_lzss_window().
    The version number lies
  • Technical detail
    Apple silently backported the CVE-2025-5915 fix (commit a612bf62) from libarchive 3.8.0 into iOS 18.6's libarchive 3.7.4 fork without updating the version string. The fix adds a guard: if (blocklength > rar->dictionary_size) return 0.
    The version number lies rar: Fix heap-buffer-overflow (#2599)
  • Technical detail
    The same memcpy in copy_from_lzss_window() had two independent overflow paths: a source over-read (CVE-2025-5915) when blocklength exceeds the window, and a destination over-write (CVE-2024-26256) when blocklength exceeds VM_MEMORY_SIZE (0x40000). Apple had already backported the CVE-2024-26256 write-side cap into iOS 18.5.
    The version number lies
  • PoC research
    On-device proof on iPhone 14 running iOS 18.5 demonstrates ~150 KB of heap disclosure through the system libarchive.2.dylib using a crafted RAR v4 archive with a 32-byte window and blocklength of 0x3C000.
    The version number lies
  • Technical detail
    The fix commit a612bf62 also contains a second independent bug fix: a wrap-around memcpy destination error in copy_from_lzss_window() where the second memcpy overwrote the start of the buffer instead of continuing at buffer + firstpart.
    The version number lies rar: Fix heap-buffer-overflow (#2599)
Supporting sources
ReferenceCVE-2025-5915 — libarchive RAR v4 heap over-read (with on-device iOS 18.5 proof)
Referencerar: Fix heap-buffer-overflow (#2599)
ReferencePatch Diffing CVE-2025-5915: Heap Buffer Over-Read in libarchive

References

5