Riskcovery

CVE-2025-5914

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

State
Published
Severity
7.8 High
Published
Jun 9, 2025
Updated
Oct 12, 2026
Reserved
Jun 9, 2025

Read the record on cve.org

Description

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hredhat

Weaknesses

  • CWE-190 Integer Overflow or Wraparound

Affected Products

ProductVersions
libarchive
  • before 3.8.0Affected
Red Hat Enterprise Linux 10Red Hat
  • 0:3.7.7-4.el10_0 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat
  • 0:3.1.2-14.el7_9.1 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:3.3.3-6.el8_10 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat
  • 0:3.3.2-8.el8_2.1 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat
  • 0:3.3.3-1.el8_4.1 and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat
  • 0:3.3.3-1.el8_4.1 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat
  • 0:3.3.3-6.el8_6 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat
  • 0:3.3.3-6.el8_6 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat
  • 0:3.3.3-6.el8_6 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat
  • 0:3.3.3-5.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat
  • 0:3.3.3-5.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:3.5.3-6.el9_6 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:3.5.3-6.el9_6 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat
  • 0:3.5.3-2.el9_0.1 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat
  • 0:3.5.3-5.el9_2 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat
  • 0:3.5.3-4.el9_4.1 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat
  • 414.92.202510211419-0 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat
  • 415.92.202601271320-0 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat
  • 416.94.202601071926-0 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat
  • 417.94.202510112152-0 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat
  • 418.94.202510230424-0 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat
  • 4.19.9.6.202510140714-0 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat
  • 4.20.9.6.202509251656-0 and laterNot affected
Red Hat Web Terminal 1.11 on RHEL 9Red Hat
  • 1.11-19 and laterNot affected
Red Hat Web Terminal 1.11 on RHEL 9Red Hat
  • 1.11-8 and laterNot affected
Red Hat Web Terminal 1.12 on RHEL 9Red Hat
  • 1.12-4 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat
  • 1.36.0-11 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat
  • 1.36.0-11 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat
  • 1.36.0-11 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat
  • 1.36.0-10 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat
  • 1.36.0-10 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat
  • 1.36.0-4 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat
  • 1.36.0-9 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat
  • 1.36.0-12 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat
  • 1.36.0-18 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat
  • 1.36.0-11 and laterNot affected
RHOSS-1.36-RHEL-8Red Hat
  • 1.36.0-7 and laterNot affected
cert-manager operator for Red Hat OpenShift 1.16Red Hat
  • v1.16.5-1760515757 and laterNot affected
Compliance Operator 1Red Hat
  • 1.8.0 and laterNot affected
Compliance Operator 1Red Hat
  • 1.8.0 and laterNot affected
Compliance Operator 1Red Hat
  • 1.8.0 and laterNot affected
OpenShift File Integrity Operator - FIO 1Red Hat
  • v1.3 and laterNot affected
Red Hat Discovery 2Red Hat
  • 2.2.1-1758555934 and laterNot affected
Red Hat Insights proxy 1.5Red Hat
  • 1.5.6-1756187445 and laterNot affected
Red Hat OpenShift distributed tracing 3.5.3Red Hat
  • rhosdt-3.5-1756116455 and laterNot affected
Red Hat OpenShift distributed tracing 3.5.3Red Hat
  • rhosdt-3.5-1756116482 and laterNot affected
Red Hat OpenShift distributed tracing 3.5.3Red Hat
  • rhosdt-3.5-1756116441 and laterNot affected
Red Hat OpenShift distributed tracing 3.5.3Red Hat
  • rhosdt-3.5-1756116449 and laterNot affected
Red Hat OpenShift distributed tracing 3.5.3Red Hat
  • rhosdt-3.5-1756116439 and laterNot affected
Red Hat OpenShift distributed tracing 3.5.3Red Hat
  • rhosdt-3.5-1756116447 and laterNot affected
Red Hat OpenShift distributed tracing 3.5.3Red Hat
  • rhosdt-3.5-1756128595 and laterNot affected
Red Hat OpenShift distributed tracing 3.5.3Red Hat
  • rhosdt-3.5-1756125872 and laterNot affected
Red Hat OpenShift distributed tracing 3.5.3Red Hat
  • rhosdt-3.5-1756116445 and laterNot affected
Red Hat OpenShift sandboxed containers 1.10Red Hat
  • 1.10.2-1757422110 and laterNot affected
Red Hat OpenShift sandboxed containers 1.10Red Hat
  • 1.10.2-1757421846 and laterNot affected
Red Hat OpenShift sandboxed containers 1.10Red Hat
  • 1.10.2-1757421804 and laterNot affected
Red Hat OpenShift sandboxed containers 1.10Red Hat
  • 1.10.2-1757422070 and laterNot affected
Red Hat OpenShift sandboxed containers 1.10Red Hat
  • 1.10.2-1757421879 and laterNot affected
Red Hat OpenShift sandboxed containers 1.10Red Hat
  • 1.10.2-1757422401 and laterNot affected
Red Hat OpenShift sandboxed containers 1.10Red Hat
  • 1.10.2-1757421890 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
    Red Hat OpenShift Container Platform 4Red Hat

      References

      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.