CVE-2025-5915: Libarchive Buffer Overflow Vulnerability

CVE-2025-5915 Overview

A heap buffer over-read vulnerability has been identified in the libarchive library, a widely-used open-source library for reading and writing streaming archives. This flaw occurs when the size of a filter block exceeds the Lempel-Ziv-Storer-Schieber (LZSS) window during archive decompression operations. When triggered, the library attempts to read beyond the allocated memory buffer boundaries, potentially resulting in application crashes, denial of service conditions, or the disclosure of sensitive information from adjacent memory regions.

Critical Impact

Exploitation of this vulnerability can lead to information disclosure from process memory or denial of service through application crashes when processing maliciously crafted archive files.

Affected Products

• libarchive libarchive (all versions prior to v3.8.0)
• Red Hat OpenShift Container Platform 4.0
• Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0, and 10.0

Discovery Timeline

• 2025-06-09 - CVE-2025-5915 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-5915

Vulnerability Analysis

This vulnerability is classified as CWE-122: Heap-based Buffer Overflow, though the specific manifestation is a heap buffer over-read condition. The flaw resides in the LZSS decompression handling within libarchive. The LZSS algorithm uses a sliding window technique for data compression, and when processing malformed or specially crafted archive data, the filter block size can exceed the expected LZSS window boundaries.

When the library processes such malformed data, it fails to properly validate that the filter block size fits within the allocated buffer space. This allows read operations to access memory beyond the intended buffer boundaries, potentially exposing sensitive data that resides in adjacent heap memory allocations.

The local attack vector requires user interaction, typically by convincing a user to open or extract a maliciously crafted archive file. Applications that automatically process archive files from untrusted sources are particularly at risk.

Root Cause

The root cause is improper bounds checking in the LZSS decompression routine. When processing compressed archive data, the code does not adequately validate that the filter block size remains within the bounds of the allocated LZSS window buffer. This missing validation allows an attacker to craft archive data that causes the decompression routine to read beyond the allocated buffer boundaries.

Attack Vector

Exploitation requires local access and user interaction, typically through the following attack scenario:

1. An attacker crafts a malicious archive file with specially constructed LZSS-compressed data
2. The malicious archive contains filter block size values that exceed the LZSS window boundaries
3. When a victim opens or extracts the archive using an application linked against a vulnerable libarchive version, the over-read occurs
4. The attacker can potentially recover sensitive information from process memory or cause application crashes

The vulnerability can be triggered through any application that uses libarchive for archive extraction, including command-line tools like bsdtar and applications with archive handling capabilities built on libarchive.

Detection Methods for CVE-2025-5915

Indicators of Compromise

• Unexpected crashes in applications using libarchive when processing archive files
• Memory access violations or segmentation faults during archive extraction operations
• Unusual archive files with abnormal compression metadata or malformed LZSS data structures
• Core dumps indicating out-of-bounds memory access in libarchive decompression functions

Detection Strategies

• Monitor for application crashes involving libarchive-linked processes during archive operations
• Implement file integrity monitoring for archive files from untrusted sources
• Deploy memory sanitizers (ASan, MSan) in development and testing environments to detect buffer over-reads
• Use static analysis tools to identify potentially vulnerable code paths in applications using libarchive

Monitoring Recommendations

• Enable crash reporting and analysis for applications that process archive files
• Implement logging for archive extraction operations, especially those involving untrusted input
• Monitor system logs for repeated segmentation faults in archive processing utilities
• Track libarchive version inventory across systems to identify vulnerable installations

How to Mitigate CVE-2025-5915

Immediate Actions Required

• Update libarchive to version v3.8.0 or later, which contains the fix for this vulnerability
• Apply vendor-specific patches from Red Hat for affected Enterprise Linux and OpenShift Container Platform deployments
• Restrict archive extraction from untrusted sources until patches are applied
• Consider sandboxing archive extraction operations to limit potential impact

Patch Information

The vulnerability has been addressed in libarchive version v3.8.0. The fix is available through GitHub Pull Request #2599, which implements proper bounds checking for the LZSS filter block size. The patched release can be obtained from the libarchive v3.8.0 release page.

For Red Hat systems, refer to the Red Hat Security Advisory for CVE-2025-5915 for distribution-specific patch information. Additional technical details are available in Red Hat Bugzilla #2370865.

Workarounds

• Avoid processing archive files from untrusted or unknown sources until systems are patched
• Implement input validation to reject malformed archive files before processing
• Run archive extraction processes in isolated environments with limited memory access capabilities
• Use application-level sandboxing (e.g., seccomp, AppArmor, SELinux) to restrict the impact of potential exploitation

# Check installed libarchive version on Linux systems
pkg-config --modversion libarchive

# For Red Hat/CentOS systems, check package version
rpm -qa | grep libarchive

# Update libarchive on Fedora/RHEL-based systems
sudo dnf update libarchive

# Update libarchive on Debian/Ubuntu-based systems
sudo apt update && sudo apt upgrade libarchive13