CVE-2025-5914

What it actually does

Integer overflow in archive_read_format_rar_seek_data() leads to double-free, enabling memory corruption that can be leveraged for arbitrary code execution or denial of service.

Why it matters to the business

Systems that extract or inspect RAR archives can be crashed or compromised when handling malicious files, potentially disrupting backup, packaging, or file-processing workflows across many applications that depend on libarchive.

How an attack unfolds

An attacker crafts a malicious RAR archive containing values that trigger the integer overflow during the seek operation in archive_read_format_rar_seek_data(); the resulting double-free corrupts heap metadata, allowing control of execution flow to achieve code execution or a crash.

How to fix it

Upgrade libarchive to the commit 70ff28fcf04ec129a1d064f96e49aa57fcc90e37 or later; rebuild and redeploy all dependent applications; test archive-handling functionality with the updated library.

How to confirm the fix worked

Confirm the installed libarchive version or commit hash matches or exceeds 70ff28fcf04ec129a1d064f96e49aa57fcc90e37; run regression tests that exercise RAR seeking paths; monitor for absence of double-free crashes on crafted inputs.

Typical attack path

1. Deliver a specially crafted RAR archive to a target process that uses libarchive for extraction or inspection
2. Trigger archive_read_format_rar_seek_data() on the malformed archive
3. Induce integer overflow leading to double-free and memory corruption
4. Leverage the corruption to execute arbitrary code or cause denial of service

How to detect it

Review application logs and crash reports for segmentation faults or heap corruption signals when processing RAR files; correlate with file-upload or archive-extraction events; no public exploit artifacts are known.

What your security team should do

• Immediately update all instances of libarchive to the fixed commit across development, build, and production environments
• Identify and inventory all downstream products and containers that statically or dynamically link libarchive
• Add archive-processing tests that include malformed RAR inputs to CI/CD pipelines
• Monitor EPSS and exploit maturity indicators for any future increase in risk