CVE-2025-5917Low· 2.8▾ SunlitA vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 15.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.2%
A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.
libarchive < 3.8.0openshift_container_platform = 4.0enterprise_linux = 6.0enterprise_linux = 7.0enterprise_linux = 8.0enterprise_linux = 9.0enterprise_linux = 10.0Upgrade past the affected range:
libarchive 3.8.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-5918Low· 3.9A vulnerability has been identified in the libarchive library
CVE-2025-5916Low· 3.9A vulnerability has been identified in the libarchive library
CVE-2025-5915Medium· 6.6A vulnerability has been identified in the libarchive library
CVE-2025-5914High· 7.8A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function
CVE-2025-64031Low· 2.5libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9
CVE-2026-16517Low· 2.9A signed integer overflow vulnerability was found in libarchive's ZIP writer