Cloudanix VulnDB

CVE-2025-5916

Low · 3.9

CVSS

3.9

EPSS

0.2%

Published

Jun 9, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in a widely used library for reading archive files can let certain specially crafted files cause crashes or unpredictable behavior on affected systems.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Integer overflow triggered during WARC archive processing when a claimed content size exceeds INT64_MAX - 4 bytes, resulting in memory corruption, unpredictable behavior, or denial of service in libarchive.

Why it matters to the business

Applications relying on libarchive for archive handling may experience crashes or erratic behavior when ingesting crafted files, leading to service disruptions, data processing failures, or limited local impact in environments that extract or inspect archives.

How an attack unfolds

An attacker creates a malicious WARC file asserting an excessively large content size to trigger the integer overflow in vulnerable libarchive versions. The file is then supplied to a target application that uses libarchive for processing, causing memory corruption or a crash under local access with user interaction.

How to fix it

Upgrade libarchive to version 3.8.0 or later; apply the specific fix present in commit 70ff28fcf04ec129a1d064f96e49aa57fcc90e37 for GIT builds.

How to confirm the fix worked

Verify installed libarchive version is 3.8.0 or newer; confirm the listed commit is present in source builds; test processing of boundary-case WARC files for absence of overflow behavior.

Typical attack path

  1. Craft a WARC archive claiming more than INT64_MAX - 4 content bytes
  2. Deliver the malicious archive to a system using a vulnerable libarchive build
  3. Trigger processing of the archive by an affected application
  4. Induce integer overflow resulting in memory corruption or denial of service

How to detect it

Monitor application logs and crash reports for errors during WARC parsing; inspect for repeated failures or abnormal memory usage when processing archive files from untrusted sources.

What your security team should do

  • Prioritize upgrade of libarchive across all affected systems and build pipelines
  • Inventory dependencies to identify downstream consumers of vulnerable versions
  • Implement archive validation or sandboxing for untrusted WARC inputs pending remediation

The record

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 libarchive 0 No fix
Debian:12 libarchive 0 No fix
Debian:13 libarchive 0 No fix
Debian:14 libarchive 0 3.7.4-4
Mageia:9 libarchive 0 3.6.2-5.5.mga9
SUSE:Linux Enterprise Micro 5.3 libarchive 0 3.5.1-150400.3.21.1
SUSE:Linux Enterprise Micro 5.4 libarchive 0 3.5.1-150400.3.21.1
SUSE:Linux Enterprise Micro 5.5 libarchive 0 3.5.1-150400.3.21.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 libarchive 0 3.7.2-150600.3.17.1
SUSE:Linux Enterprise Module for Basesystem 15 SP7 libarchive 0 3.7.2-150600.3.17.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 libarchive 0 3.7.2-150600.3.17.1
SUSE:Linux Enterprise Module for Development Tools 15 SP7 libarchive 0 3.7.2-150600.3.17.1
SUSE:Linux Enterprise Server 12 SP5-LTSS libarchive 0 3.3.3-32.14.1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 libarchive 0 3.3.3-32.14.1
openSUSE:Leap 15.6 libarchive 0 3.7.2-150600.3.17.1
openSUSE:Tumbleweed rpi-imager 0 1.9.5-1.1

Related vulnerabilities