High
Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c
Type: advisorySources: OSV
A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-5914
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 08:26 UTC · Revision 1
Source evidence
Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c
core-osv · Original sourcePublished 9 Jun 2025, 19:53 UTC
A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.
osv:CVE-2025-5914
Complete source record
{
"id": "3ae21a9b4b890a480ccdce6605da61376aea130c1f9fbf95ef16df5c32417cc5",
"url": "https://osv.dev/vulnerability/CVE-2025-5914",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c",
"summary": "A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.",
"evidence": "osv:CVE-2025-5914",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-5914",
"aliases": [
"CVE-2025-5914"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/libarchive/libarchive",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "70ff28fcf04ec129a1d064f96e49aa57fcc90e37"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "3.8.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "70ff28fcf04ec129a1d064f96e49aa57fcc90e37"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v3.8.0"
},
{
"cpe": "cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.8.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v3.7.5",
"v3.7.4",
"v3.7.3",
"v3.7.2",
"v3.7.1",
"v3.7.0",
"v3.6.2",
"v3.6.1",
"v3.6.0",
"v3.5.2",
"v3.5.1",
"v3.5.0",
"v3.4.3",
"v3.4.2",
"v3.4.1",
"v3.4.0",
"v3.3.3",
"v3.3.2",
"v3.3.1",
"v3.3.0",
"v3.2.2",
"v3.2.1",
"v3.2.0",
"v3.1.900a",
"v3.0.1b",
"v3.0.0a"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5914.json"
}
}
],
"modified": "2026-10-28T02:30:27.096305617Z",
"provider": "osv",
"references": [
"https://access.redhat.com/downloads/content/package-browser/",
"https://catalog.redhat.com/software/containers/",
"https://cert-portal.siemens.com/productcert/html/ssa-585531.html",
"https://github.com/libarchive/libarchive/",
"https://github.com/libarchive/libarchive/releases/tag/v3.8.0",
"https://access.redhat.com/errata/RHSA-2025:14130",
"https://access.redhat.com/errata/RHSA-2025:14135",
"https://access.redhat.com/errata/RHSA-2025:14137",
"https://access.redhat.com/errata/RHSA-2025:14141",
"https://access.redhat.com/errata/RHSA-2025:14142",
"https://access.redhat.com/errata/RHSA-2025:14525",
"https://access.redhat.com/errata/RHSA-2025:14528",
"https://access.redhat.com/errata/RHSA-2025:14594",
"https://access.redhat.com/errata/RHSA-2025:14644",
"https://access.redhat.com/errata/RHSA-2025:14808",
"https://access.redhat.com/errata/RHSA-2025:14810",
"https://access.redhat.com/errata/RHSA-2025:14828",
"https://access.redhat.com/errata/RHSA-2025:15024",
"https://access.redhat.com/errata/RHSA-2025:15397",
"https://access.redhat.com/errata/RHSA-2025:15709",
"https://access.redhat.com/errata/RHSA-2025:15827",
"https://access.redhat.com/errata/RHSA-2025:15828",
"https://access.redhat.com/errata/RHSA-2025:16524",
"https://access.redhat.com/errata/RHSA-2025:18217",
"https://access.redhat.com/errata/RHSA-2025:18218",
"https://access.redhat.com/errata/RHSA-2025:18219",
"https://access.redhat.com/errata/RHSA-2025:19041",
"https://access.redhat.com/errata/RHSA-2025:19046",
"https://access.redhat.com/errata/RHSA-2025:21885",
"https://access.redhat.com/errata/RHSA-2025:21913",
"https://access.redhat.com/errata/RHSA-2026:0326",
"https://access.redhat.com/errata/RHSA-2026:0934",
"https://access.redhat.com/errata/RHSA-2026:1541",
"https://access.redhat.com/security/cve/CVE-2025-5914",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5914.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-5914",
"https://bugzilla.redhat.com/show_bug.cgi?id=2370861",
"https://github.com/libarchive/libarchive/pull/2598"
],
"provider_metadata": {
"cwe_ids": [
"CWE-190"
],
"cna_assigner": "redhat",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "0:3.7.7-4.el10_0"
},
{
"fixed": "0:3.1.2-14.el7_9.1"
},
{
"fixed": "0:3.3.3-6.el8_10"
},
{
"fixed": "0:3.3.2-8.el8_2.1"
},
{
"fixed": "0:3.3.3-1.el8_4.1"
},
{
"fixed": "0:3.3.3-1.el8_4.1"
},
{
"fixed": "0:3.3.3-6.el8_6"
},
{
"fixed": "0:3.3.3-6.el8_6"
},
{
"fixed": "0:3.3.3-6.el8_6"
},
{
"fixed": "0:3.3.3-5.el8_8.1"
},
{
"fixed": "0:3.3.3-5.el8_8.1"
},
{
"fixed": "0:3.5.3-6.el9_6"
},
{
"fixed": "0:3.5.3-6.el9_6"
},
{
"fixed": "0:3.5.3-2.el9_0.1"
},
{
"fixed": "0:3.5.3-5.el9_2"
},
{
"fixed": "0:3.5.3-4.el9_4.1"
},
{
"fixed": "414.92.202510211419-0"
},
{
"fixed": "415.92.202601271320-0"
},
{
"fixed": "416.94.202601071926-0"
},
{
"fixed": "417.94.202510112152-0"
},
{
"fixed": "418.94.202510230424-0"
},
{
"fixed": "4.19.9.6.202510140714-0"
},
{
"fixed": "4.20.9.6.202509251656-0"
},
{
"fixed": "1.11-19"
},
{
"fixed": "1.11-8"
},
{
"fixed": "1.12-4"
},
{
"fixed": "1.36.0-11"
},
{
"fixed": "1.36.0-11"
},
{
"fixed": "1.36.0-11"
},
{
"fixed": "1.36.0-10"
},
{
"fixed": "1.36.0-10"
},
{
"fixed": "1.36.0-4"
},
{
"fixed": "1.36.0-9"
},
{
"fixed": "1.36.0-12"
},
{
"fixed": "1.36.0-18"
},
{
"fixed": "1.36.0-11"
},
{
"fixed": "1.36.0-7"
},
{
"fixed": "v1.16.5-1760515757"
},
{
"fixed": "1.8.0"
},
{
"fixed": "1.8.0"
},
{
"fixed": "1.8.0"
},
{
"fixed": "v1.3"
},
{
"fixed": "2.2.1-1758555934"
},
{
"fixed": "1.5.6-1756187445"
},
{
"fixed": "rhosdt-3.5-1756116455"
},
{
"fixed": "rhosdt-3.5-1756116482"
},
{
"fixed": "rhosdt-3.5-1756116441"
},
{
"fixed": "rhosdt-3.5-1756116449"
},
{
"fixed": "rhosdt-3.5-1756116439"
},
{
"fixed": "rhosdt-3.5-1756116447"
},
{
"fixed": "rhosdt-3.5-1756128595"
},
{
"fixed": "rhosdt-3.5-1756125872"
},
{
"fixed": "rhosdt-3.5-1756116445"
},
{
"fixed": "1.10.2-1757422110"
},
{
"fixed": "1.10.2-1757421846"
},
{
"fixed": "1.10.2-1757421804"
},
{
"fixed": "1.10.2-1757422070"
},
{
"fixed": "1.10.2-1757421879"
},
{
"fixed": "1.10.2-1757422401"
},
{
"fixed": "1.10.2-1757421890"
}
],
"source": "AFFECTED_FIELD",
"strategy": "InverseAffectedRanges"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5914.json"
}
},
"related_cves": [
{
"value": "CVE-2025-5914",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493809,
"published_at": "2025-06-09T19:53:48.923+00:00"
}