CVE-2025-64031: Buffer Overflow
libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Exposure is limited to libarchive 3.8.x releases before 3.8.2 when using the gzip writer, including the bsdtar-related scenario described. Exploitation is considered only marginally plausible when the original-filename value comes from an untrusted party.
Does processing an untrusted input archive trigger the overflow?
No. The original-filename field is not derived from the input data, so handling untrusted archive contents alone does not create the described condition.
What must an attacker control to exploit this?
An attacker would need to influence the original-filename supplied to archive_compressor_gzip_open while the affected gzip-writing path is used. The provided vector also requires local access, high attack complexity, and user interaction.