CVE-2025-5914: Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c
A vulnerability has been identified in the libarchive library, specifically within the archivereadformatrarseekdata() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.
Other sources
In libarchive before 3.8.0, an integer overflow in the archivereadformatrarseekdata() function may lead to a double free problem.
— Red Hat
Libarchive: double free at archivereadformatrarseekdata() in archivereadsupportformatrar.c
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.7-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.1-7 - Upgrade
Upgrade
libarchiveto a version that resolves this vulnerability.Fixed in 3.8.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5914?
The severity of CVE-2025-5914 is high due to the potential for an integer overflow leading to a double-free condition.
How do I fix CVE-2025-5914?
To fix CVE-2025-5914, update the libarchive library to the latest version that addresses this vulnerability.
What are the potential impacts of exploiting CVE-2025-5914?
Exploiting CVE-2025-5914 may result in memory corruption, application crashes, or potential code execution depending on the context.
Which software is affected by CVE-2025-5914?
CVE-2025-5914 affects applications utilizing the libarchive library, particularly those handling RAR file formats.
Is CVE-2025-5914 a local or remote vulnerability?
CVE-2025-5914 can be exploited remotely if an attacker can manipulate file input to the affected applications.