CVE-2025-5915

What it actually does

Heap buffer over-read in libarchive's LZSS filter handling when a filter block size exceeds the decompression window, resulting in out-of-bounds memory reads.

Why it matters to the business

Systems using libarchive for archive processing may experience crashes that disrupt services or leak memory contents that expose sensitive data, increasing operational downtime and compliance risks.

How an attack unfolds

An attacker supplies a crafted archive containing an LZSS-compressed block sized larger than the library's window; when libarchive processes the archive the over-read occurs, enabling denial of service or disclosure of adjacent memory regions.

How to fix it

Upgrade libarchive to the version containing commit 70ff28fcf04ec129a1d064f96e49aa57fcc90e37 or later; rebuild and redeploy all dependent applications.

How to confirm the fix worked

Confirm the running libarchive binary or source contains commit 70ff28fcf04ec129a1d064f96e49aa57fcc90e37; fuzz test archive parsing paths with oversized LZSS blocks to verify absence of over-reads.

Typical attack path

1. Craft a malicious archive file with an oversized LZSS filter block
2. Deliver the archive to a target system via file upload, email, or package repository
3. Trigger archive processing through any application that uses the vulnerable libarchive library
4. Observe resulting crash or memory disclosure from the out-of-bounds read

How to detect it

Review system and application logs for segmentation faults or abnormal terminations during archive extraction; inspect core dumps or memory sanitizer reports for out-of-bounds read signatures near LZSS decompression code.

What your security team should do

• Immediately update all instances of libarchive to the fixed commit
• Inventory and replace vulnerable copies in build pipelines and runtime environments
• Add archive-processing crash monitoring to existing alerting rules