CVE-2025-5917

Libarchive: off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c

Description

A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation.

Remediation

Workaround:

  • Upgrade to libarchive version 3.8.0 or later, which includes important security fixes and stability improvements.

Category

2.8
CVSS
Severity: Low
CVSS 3.1 •
EPSS 0.01%
Vendor Advisory redhat.com
Affected: Red Hat Red Hat Enterprise Linux 10
Affected: Red Hat Red Hat Enterprise Linux 6
Affected: Red Hat Red Hat Enterprise Linux 7
Affected: Red Hat Red Hat Enterprise Linux 8
Affected: Red Hat Red Hat Enterprise Linux 9
Affected: Red Hat Red Hat OpenShift Container Platform 4
Published at:
Updated at:

References

Link Tags
https://access.redhat.com/security/cve/CVE-2025-5917 vendor advisory vdb entry
https://bugzilla.redhat.com/show_bug.cgi?id=2370874 issue tracking
https://github.com/libarchive/libarchive/pull/2588 patch
https://github.com/libarchive/libarchive/releases/tag/v3.8.0 release notes

Frequently Asked Questions

What is the severity of CVE-2025-5917?
CVE-2025-5917 has been scored as a low severity vulnerability.
How to fix CVE-2025-5917?
As a workaround for remediating CVE-2025-5917: Upgrade to libarchive version 3.8.0 or later, which includes important security fixes and stability improvements.
Is CVE-2025-5917 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-5917 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-5917?
CVE-2025-5917 affects Red Hat Red Hat Enterprise Linux 10, Red Hat Red Hat Enterprise Linux 6, Red Hat Red Hat Enterprise Linux 7, Red Hat Red Hat Enterprise Linux 8, Red Hat Red Hat Enterprise Linux 9, Red Hat Red Hat OpenShift Container Platform 4.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.