CVE-2025-5917

LOW

libarchive < 3.8.0 - Out-of-bounds Write via File Name Prefix/Suffix Handling

Title source: llm
STIX 2.1

Description

A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.

References (4)

Core 4

Scores

CVSS v3 2.8
EPSS 0.0012
EPSS Percentile 30.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-787
Status published
Products (7)
libarchive/libarchive < 3.8.0
redhat/enterprise_linux 6.0
redhat/enterprise_linux 7.0
redhat/enterprise_linux 8.0
redhat/enterprise_linux 9.0
redhat/enterprise_linux 10.0
redhat/openshift_container_platform 4.0
Published Jun 09, 2025
Tracked Since Feb 18, 2026