A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Libarchive
  • Libarchive
Redhat
  • Enterprise Linux
  • Openshift
  • Openshift Container Platform
  • Rhel E4s
  • Rhel Eus

Configuration 1 [-]

cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

No data.

References
Link Providers
https://access.redhat.com/errata/RHSA-2025:14130 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:14135 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:14137 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:14141 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:14142 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2025-5914 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2370861 cve-icon cve-icon
https://github.com/libarchive/libarchive/pull/2598 cve-icon cve-icon cve-icon cve-icon
https://github.com/libarchive/libarchive/releases/tag/v3.8.0 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-5914 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-5914 cve-icon
History

Wed, 20 Aug 2025 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/a:redhat:rhel_eus:9.4::crb
cpe:/o:redhat:rhel_eus:9.4::baseos
Vendors & Products Redhat rhel Eus
References

Wed, 20 Aug 2025 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.0::appstream
cpe:/o:redhat:rhel_e4s:9.0::baseos
Vendors & Products Redhat rhel E4s
References

Wed, 20 Aug 2025 09:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9		 cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:8::baseos
cpe:/o:redhat:enterprise_linux:9::baseos
References

Wed, 20 Aug 2025 08:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.0
References

Tue, 12 Aug 2025 10:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 3.9, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L'}

 cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00034}

 epss

{'score': 0.00039}

Fri, 20 Jun 2025 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Libarchive
Libarchive libarchive
Redhat openshift Container Platform
CPEs cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Libarchive
Libarchive libarchive
Redhat openshift Container Platform

Tue, 10 Jun 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Jun 2025 02:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 09 Jun 2025 20:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.
Title Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-415
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 3.9, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L'}
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2025-06-09T19:53:48.923Z

Updated: 2025-08-20T14:59:46.471Z

Reserved: 2025-06-09T08:10:18.779Z

Link: CVE-2025-5914

cve-icon Vulnrichment

Updated: 2025-06-10T14:23:42.747Z

cve-icon NVD

Status : Modified

Published: 2025-06-09T20:15:26.123

Modified: 2025-08-20T15:15:35.480

Link: CVE-2025-5914

cve-icon Redhat

Severity : Low

Publid Date: 2025-05-20T00:00:00Z

Links: CVE-2025-5914 - Bugzilla