CVE-2025-5918

What it actually does

Out-of-bounds read in libarchive when processing piped file streams via bsdtar, resulting in memory corruption, unpredictable behavior, or denial of service.

Why it matters to the business

Archive extraction or inspection tools on systems using libarchive may crash or produce unreliable output when handling streamed input, increasing operational risk for backup, packaging, and distribution workflows; the low exploitability and absence from known exploited lists reduce immediate urgency but the widespread use of the library still warrants prompt patching.

How an attack unfolds

An attacker with local access crafts or supplies a file stream that triggers the out-of-bounds read condition when fed into bsdtar; no public exploits or named threat actors are associated with this issue.

How to fix it

Update libarchive to the commit 70ff28fcf04ec129a1d064f96e49aa57fcc90e37 or later; rebuild and redeploy any dependent packages that statically link the library.

How to confirm the fix worked

Confirm the installed libarchive version or build contains commit 70ff28fcf04ec129a1d064f96e49aa57fcc90e37; run regression tests that exercise piped bsdtar operations with varied archive streams.

Typical attack path

1. Obtain local access or ability to supply input to bsdtar on the target system
2. Pipe a specially constructed file stream into bsdtar
3. Trigger the out-of-bounds read leading to memory corruption or crash

How to detect it

Review system and application logs for unexpected bsdtar crashes or segmentation faults during archive operations; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize upgrade of libarchive to the fixed commit across all build and runtime environments
• Scan package manifests and container images for affected libarchive versions
• Monitor EPSS trend for any future increase in exploitation likelihood