CVE-2025-5918CWE-125

CVE-2025-5918

Low · published June 10, 2025

CVSS v3.1
3.9
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.

The record
Technical detail
CVSS v3.1
3.9 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00377 · 30.5th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-06-10T00:15Z
Affected products (6)
ProductVersionsFixed in
libarchive/libarchive< 3.8.03.8.0
redhat/openshift_container_platformall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
References (4)
https://access.redhat.com/security/cve/CVE-2025-5918 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2370877 · [email protected]https://github.com/libarchive/libarchive/pull/2584 · [email protected]https://github.com/libarchive/libarchive/releases/tag/v3.8.0 · [email protected]
EPSS history
Timeline
  • 09 JUN 19:49Z
    Libarchive: reading past eof may be triggered for piped file streams
    cvelistv5