---
id: CVE-2025-5915
title: A vulnerability has been identified in the libarchive library
summary: >-
  A vulnerability has been identified in the libarchive library. This flaw can
  lead to a heap buffer over-read due to the size of a filter block potentially
  exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library
  may…
severity: medium
cvss: 6.6
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H'
cwe:
  - CWE-122
vendor: libarchive
product: libarchive
affected:
  - libarchive < 3.8.0
  - openshift_container_platform = 4.0
  - enterprise_linux = 6.0
  - enterprise_linux = 7.0
  - enterprise_linux = 8.0
  - enterprise_linux = 9.0
  - enterprise_linux = 10.0
patched:
  - libarchive 3.8.0
published: '2025-06-09'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-5915'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2025-5915'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2370865'
    label: secalert@redhat.com
  - url: 'https://github.com/libarchive/libarchive/pull/2599'
    label: secalert@redhat.com
  - url: 'https://github.com/libarchive/libarchive/releases/tag/v3.8.0'
    label: secalert@redhat.com
tags:
  - nvd
  - exploit-available
epss: 0.00192
epssPercentile: 0.09154
ingestedAt: '2026-06-29T13:24:34.357Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/R3n3r0/cve-2025-5915'
  checkedAt: '2026-09-24T07:52:53.694Z'
exploitAvailable: true
---

## Overview

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.

## Affected

- `libarchive < 3.8.0`
- `openshift_container_platform = 4.0`
- `enterprise_linux = 6.0`
- `enterprise_linux = 7.0`
- `enterprise_linux = 8.0`
- `enterprise_linux = 9.0`
- `enterprise_linux = 10.0`

## Remediation

Upgrade past the affected range:

- `libarchive 3.8.0`