CVE-2025-5915
MEDIUM severity · CVSS 6.6 · CWE-122
6.6CVSS MEDIUM
Summary
A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.
Impact & exploitability
Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionRequired
Confidentiality impactHigh
Integrity impactNone
Availability impactHigh
Exploit probability (EPSS)0%
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Affected products we track (2)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: https://github.com/libarchive/libarchive/pull/2599 ↗