7.8High

CVE-2025-5914Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

libarchive; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8 Published: 2025-06-09 22:53 (1 year ago)

Description

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

Weakness (CWE): CWE-190

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
cert manager	1.16	—
confidential compute attestation	1.10	—
discovery	2	—
enterprise linux	8	—
enterprise linux	9	—
insights proxy	1.5	—
libarchive	libarchive	< 3.8.0
openshift	4.14	—
openshift	4.15	—
openshift	4.16	—
openshift	4.17	—
openshift	4.18	—
openshift	4.19	—
openshift	4.20	—
openshift compliance operator	1	—
openshift distributed tracing	3.5	—
openshift file integrity operator	1	—
openshift serverless	1.36	—
Red Hat	cert-manager operator for Red Hat OpenShift 1.16	all versions
redhat	enterprise linux	6.0
Red Hat	OpenShift Compliance Operator 1	all versions
redhat	openshift container platform	4.0
Red Hat	OpenShift File Integrity Operator - FIO 1	all versions
Red Hat	Red Hat Discovery 2	all versions
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	all versions
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	all versions
Red Hat	Red Hat Insights proxy 1.5	all versions
Red Hat	Red Hat OpenShift Container Platform 4	—
Red Hat	Red Hat OpenShift Container Platform 4.14	all versions
Red Hat	Red Hat OpenShift Container Platform 4.15	all versions
Red Hat	Red Hat OpenShift Container Platform 4.16	all versions
Red Hat	Red Hat OpenShift Container Platform 4.17	all versions
Red Hat	Red Hat OpenShift Container Platform 4.18	all versions
Red Hat	Red Hat OpenShift Container Platform 4.19	all versions
Red Hat	Red Hat OpenShift Container Platform 4.20	all versions
Red Hat	Red Hat OpenShift distributed tracing 3.5.3	all versions
Red Hat	Red Hat OpenShift sandboxed containers 1.10	all versions
Red Hat	Red Hat Web Terminal 1.11 on RHEL 9	all versions
Red Hat	Red Hat Web Terminal 1.12 on RHEL 9	all versions
Red Hat	RHOSS-1.36-RHEL-8	all versions
rhel aus	8.2	—
rhel aus	8.4	—
rhel aus	8.6	—
rhel e4s	8.6	—
rhel e4s	8.8	—
rhel e4s	9.0	—
rhel e4s	9.2	—
rhel eus	9.4	—
rhel eus long life	8.4	—
rhel tus	8.6	—
rhel tus	8.8	—
Siemens	SIDIS Secured SmartPlug	< V7.26.0310
—	libarchive	< 3.8.0
webterminal	1.11	—
webterminal	1.12	—

References and patches

RHSA-2025:14130 vendor-advisoryThird Party Advisory
RHSA-2025:14135 vendor-advisoryThird Party Advisory
RHSA-2025:14137 vendor-advisoryThird Party Advisory
RHSA-2025:14141 vendor-advisoryThird Party Advisory
RHSA-2025:14142 vendor-advisoryThird Party Advisory
RHSA-2025:14525 vendor-advisoryThird Party Advisory
RHSA-2025:14528 vendor-advisoryThird Party Advisory
RHSA-2025:14594 vendor-advisoryThird Party Advisory
RHSA-2025:14644 vendor-advisoryThird Party Advisory
RHSA-2025:14808 vendor-advisoryThird Party Advisory
RHSA-2025:14810 vendor-advisoryThird Party Advisory
RHSA-2025:14828 vendor-advisoryThird Party Advisory
RHSA-2025:15024 vendor-advisoryThird Party Advisory
RHSA-2025:15397 vendor-advisoryThird Party Advisory
RHSA-2025:15709 vendor-advisoryThird Party Advisory
RHSA-2025:15827 vendor-advisoryThird Party Advisory
RHSA-2025:15828 vendor-advisoryThird Party Advisory
RHSA-2025:16524 vendor-advisoryThird Party Advisory
RHSA-2025:18217 vendor-advisoryThird Party Advisory
RHSA-2025:18218 vendor-advisoryThird Party Advisory
RHSA-2025:18219 vendor-advisoryThird Party Advisory
RHSA-2025:19041 vendor-advisoryThird Party Advisory
RHSA-2025:19046 vendor-advisoryThird Party Advisory
RHSA-2025:21885 vendor-advisoryThird Party Advisory
RHSA-2025:21913 vendor-advisoryThird Party Advisory
RHSA-2026:0326 vendor-advisoryThird Party Advisory
RHSA-2026:0934 vendor-advisory
RHSA-2026:1541 vendor-advisory
https://access.redhat.com/security/cve/CVE-2025-5914 vdb-entryThird Party Advisory
RHBZ#2370861 issue-trackingIssue TrackingThird Party Advisory
https://github.com/libarchive/libarchive/pull/2598 ExploitIssue TrackingPatch
https://github.com/libarchive/libarchive/releases/tag/v3.8.0 Release Notes
https://cert-portal.siemens.com/productcert/html/ssa-585531.html

CPE matches (NVD) (7)

cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:* < 3.8.0
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

CVSS score

7.8High

Source: redhat · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

All scores (3)

cna	CVSS 3.1	7.8High
secalert@redhat.com	CVSS 3.1	7.8High
nvd	CVSS 3.1	7.8High

EPSS (chance of exploitation in 30 days)

0.49%

higher than 43% of all CVEs

CISA assessment (SSVC)

Exploitation: poc
Automatable: no
Technical impact: partial

Timeline

ID reserved2025-06-09
Published2025-06-09 22:53
Reached IP-DB2026-10-25 00:00
Last updated2026-11-06 04:17

Assigned by (CNA): redhat
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Red Hat Enterprise Linux

6.2Medium

CVE-2026-128886 3 hours ago

Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because th…

5.5Medium

CVE-2026-110330 4 hours ago

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8High

CVE-2026-110331 4 hours ago

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…

6.2Medium

CVE-2026-128987 4 hours ago

Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…

5.5Medium

CVE-2026-128885 4 hours ago

Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize

Red Hat Red Hat Enterprise Linux 10

A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…

8.8High

CVE-2026-18379 yesterday

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…