CVE-2025-5917

What it actually does

Off-by-one miscalculation during prefix/suffix handling for archive entry filenames triggers a single-byte write beyond allocated buffer, corrupting adjacent heap memory and potentially causing crashes or enabling limited control-flow manipulation.

Why it matters to the business

Applications that extract or list archives may crash or behave unpredictably when processing malicious files, leading to disrupted backup, packaging, or distribution workflows and requiring emergency patching across developer and operations tooling.

How an attack unfolds

An attacker crafts an archive entry whose filename prefix or suffix is sized to trigger the off-by-one write during parsing; the malformed archive is supplied to any process using a vulnerable libarchive build, resulting in memory corruption that can be chained for denial of service or, in ideal conditions, further exploitation.

How to fix it

Upgrade libarchive to version 3.8.0 or later; the specific fix is present in commit 70ff28fcf04ec129a1d064f96e49aa57fcc90e37. Rebuild and redeploy all dependent packages and containers. Until patches are applied, restrict untrusted archive processing to isolated environments.

How to confirm the fix worked

Confirm installed libarchive version is 3.8.0 or newer; run regression tests with archives containing long prefix/suffix filename combinations; monitor for absence of crashes or heap sanitizer violations on previously triggering inputs.

Typical attack path

1. Identify target application or script that uses libarchive to read archives
2. Craft archive containing filename metadata engineered to overflow by one byte
3. Deliver archive via download, attachment, or shared storage
4. Trigger parsing of the archive entry names inside the vulnerable process
5. Observe crash or attempt to leverage resulting memory corruption

How to detect it

Review process crash logs and core dumps for libarchive-related segmentation faults; inspect application logs for sudden failures during archive extraction; correlate with file creation or download events involving archives from untrusted sources.

What your security team should do

• Prioritize patching all systems that invoke libarchive on untrusted input within 30 days
• Add libarchive version checks to software bill-of-materials and dependency scanners
• Enable heap integrity protections and ASLR on hosts running archive utilities
• Restrict archive extraction privileges to least-privilege service accounts