CVE-2025-64031: libarchive Heap Buffer Overflow Vulnerability

CVE-2025-64031 Overview

CVE-2025-64031 is a heap-based buffer overflow [CWE-122] in libarchive versions 3.8.x before 3.8.2. The flaw resides in the archive_compressor_gzip_open function within archive_write_add_filter_gzip.c. An unsafe strcpy call copies the original-filename field into a fixed-size heap buffer without bounds checking. The issue affects bsdtar and any application that uses libarchive's gzip writer filter. The advisory is tracked as GHSA-92wx-p669-8gr9.

Exploitation requires a marginally plausible scenario where the original-filename value originates from an untrusted party. The field is not derived from input archive data, which limits realistic attack paths.

Critical Impact
A local attacker able to control the gzip original-filename field can trigger a heap buffer overflow in bsdtar or libarchive-linked applications, potentially causing process crashes or memory corruption.

Affected Products

libarchive 3.8.0 through 3.8.1
bsdtar builds linking affected libarchive versions
Third-party applications using archive_write_add_filter_gzip

Discovery Timeline

2026-09-14 - CVE-2025-64031 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2025-64031

Vulnerability Analysis

The vulnerability lives in libarchive's gzip write filter. When callers initialize a gzip output stream, archive_compressor_gzip_open builds the gzip header including the optional original-filename field. The implementation uses strcpy to copy the caller-supplied filename into a fixed-size heap allocation. When the filename length exceeds the destination buffer, the write overflows into adjacent heap memory.

The overflow is triggered at archive creation time rather than during extraction. The attacker must supply the filename value to a program that forwards it into libarchive's gzip filter configuration. The bug corrupts heap metadata and can crash the calling process or, depending on heap state, produce exploitable memory corruption. Impact is bounded by the local attack vector and required user interaction.

Root Cause

The root cause is missing length validation before a strcpy operation in archive_write_add_filter_gzip.c. The gzip original-filename field is copied verbatim into a heap buffer sized for typical filename lengths. libarchive treats the field as trusted caller input, so no truncation or bounds check is performed. Any filename longer than the destination allocation overflows the heap.

Attack Vector

An attacker needs a program path that lets an untrusted party influence the original-filename passed to the gzip writer. In bsdtar, this typically means a user constructing an archive from attacker-supplied metadata. The attacker cannot reach the vulnerable code through a crafted input archive, since the field is not parsed from archive data. Successful exploitation requires local access and user interaction, and impacts availability. See the libarchive pull request and upstream source for the fix details.

A proof-of-concept is published in a GitHub Gist demonstrating the overflow condition.

Detection Methods for CVE-2025-64031

Indicators of Compromise

Unexpected bsdtar or libarchive-linked process crashes with SIGABRT or SIGSEGV during archive creation
Heap corruption diagnostics from glibc such as malloc(): corrupted top size or free(): invalid pointer originating from gzip write operations
Core dumps referencing archive_compressor_gzip_open in the crashing stack frame

Detection Strategies

Inventory installed libarchive versions across Linux and BSD hosts and flag any 3.8.0 or 3.8.1 builds
Audit application code that calls archive_write_add_filter_gzip with externally influenced filename metadata
Enable AddressSanitizer in test builds to surface the overflow during fuzzing of gzip archive creation paths

Monitoring Recommendations

Forward system crash reports and abrt/coredumpctl events to centralized logging for review
Alert on repeated crashes of archive utilities on shared or multi-user systems
Track package versions of libarchive and bsdtar through configuration management or SBOM tooling

How to Mitigate CVE-2025-64031

Immediate Actions Required

Upgrade libarchive to version 3.8.2 or later on all affected systems
Rebuild statically linked applications that bundle vulnerable libarchive versions
Restrict use of bsdtar in workflows that accept untrusted filename metadata until patched

Patch Information

The fix is included in libarchive 3.8.2 and merged via pull request #2734. The patch replaces the unsafe strcpy with a length-checked copy so that oversized filenames no longer overflow the destination buffer. Review the changed files for the precise remediation.

Workarounds

Sanitize and truncate any filename value passed to libarchive's gzip writer to a safe maximum length before calling the API
Avoid setting the gzip original-filename field from untrusted sources when a patched libarchive build is not yet available
Isolate archive creation tasks that process untrusted metadata inside sandboxed or containerized processes

bash

# Verify installed libarchive version on Debian/Ubuntu
dpkg -l | grep libarchive

# Verify on RHEL/Fedora
rpm -q libarchive

# Upgrade example (Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade libarchive13