CVE-2025-25724

What it actually does

The list_item_verbose function in tar/util.c fails to check the return value of strftime, allowing a crafted TAR archive processed at verbose level 2 to produce output exceeding the 100-byte buffer in custom locales and trigger denial of service or other unspecified effects.

Why it matters to the business

Applications relying on libarchive for TAR handling can be disrupted by specially crafted archive files, causing service outages or unpredictable behavior during file operations.

How an attack unfolds

An attacker prepares a TAR archive containing locale-specific timestamp data that forces strftime to return a long string when verbose processing is enabled at level 2; the missing return-value check then allows the buffer overflow or crash condition to manifest during archive listing.

How to fix it

Upgrade libarchive past version 3.7.7 and ensure strftime return values are validated before use in tar/util.c; rebuild dependent applications against the patched library.

How to confirm the fix worked

Compile and run unit tests that feed verbose-level-2 TAR archives with long locale strings, then confirm no buffer overruns or crashes occur and that strftime return values are explicitly checked.

Typical attack path

1. Craft a TAR archive that triggers excessive strftime output under verbose level 2
2. Deliver the archive to a target process that calls list_item_verbose
3. Trigger archive reading to invoke the unchecked strftime path
4. Observe denial of service or secondary impact from buffer mishandling

How to detect it

Inspect application and system logs for segmentation faults or abnormal exits during TAR extraction with verbose output enabled; correlate crashes with receipt of external archive files.

What your security team should do

• Prioritize updating all instances of libarchive to a fixed release
• Add input-size and locale checks around verbose TAR processing in custom code
• Review application logs for crashes during archive extraction