---
id: CVE-2025-5918
title: A vulnerability has been identified in the libarchive library
summary: >-
  A vulnerability has been identified in the libarchive library. This flaw can
  be triggered when file streams are piped into bsdtar, potentially allowing for
  reading past the end of the file. This out-of-bounds read can lead to
  unintended …
severity: low
cvss: 3.9
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L'
cwe:
  - CWE-125
vendor: libarchive
product: libarchive
affected:
  - libarchive < 3.8.0
  - openshift_container_platform = 4.0
  - enterprise_linux = 6.0
  - enterprise_linux = 7.0
  - enterprise_linux = 8.0
  - enterprise_linux = 9.0
patched:
  - libarchive 3.8.0
published: '2025-06-09'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-5918'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2025-5918'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2370877'
    label: secalert@redhat.com
  - url: 'https://github.com/libarchive/libarchive/pull/2584'
    label: secalert@redhat.com
  - url: 'https://github.com/libarchive/libarchive/releases/tag/v3.8.0'
    label: secalert@redhat.com
tags:
  - nvd
epss: 0.00368
epssPercentile: 0.27898
ingestedAt: '2026-06-29T13:24:34.363Z'
---

## Overview

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.

## Affected

- `libarchive < 3.8.0`
- `openshift_container_platform = 4.0`
- `enterprise_linux = 6.0`
- `enterprise_linux = 7.0`
- `enterprise_linux = 8.0`
- `enterprise_linux = 9.0`

## Remediation

Upgrade past the affected range:

- `libarchive 3.8.0`