CVE-2025-5916

Published Jun 9, 2025

Last updated 3 months ago

CVSS low 3.9

Overview

Description
A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.
Source
secalert@redhat.com
NVD status
Modified
Products
libarchive, openshift_container_platform, enterprise_linux

Risk scores

CVSS 3.1

Type
Primary
Base score
5.6
Impact score
4.2
Exploitability score
1.3
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Severity
MEDIUM

Weaknesses

secalert@redhat.com
CWE-190

Social media

Hype score
Not currently trending

  1. 🚨 CVE-2025-5916 Patch Alert! @openSUSE Tumbleweed users: ⚠️ rpi-imager vuln allows local code execution ✅ Fix: zypper update rpi-imager Read more: 👉 https://t.co/GP6YlAH5be #infosec #DevSecOps #RaspberryPi https://t.co/3tE67DnD

    @Cezar_H_Linux

    28 Jul 2025

    13 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. CVE-2025-5916 Integer Overflow in Libarchive WARC File Processing Leads to Potential Memory Corruption https://t.co/83hB0puwAV

    @VulmonFeeds

    10 Jun 2025

    10 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CVE-2025-5916 A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file th… https://t.co/Nv38Zf9NgG

    @CVEnew

    9 Jun 2025

    412 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.•CVE-2025-12801
  2. A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.•CVE-2026-26104
  3. A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.•CVE-2026-26103
  4. A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.•CVE-2026-1709
  5. A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.•CVE-2025-14512

References

Sources include official advisories and independent security research.