CVE-2025-5915: Heap-based Buffer Overflow
A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.
AI Analysis
Technical Summary
This vulnerability in libarchive arises from a heap buffer over-read when the size of a filter block exceeds the LZSS window size. This causes the library to access memory beyond the allocated buffer, potentially resulting in application crashes or leakage of sensitive data. The issue affects Red Hat Enterprise Linux 10. The CVSS vector indicates the attack requires local access with low complexity, privileges, and user interaction, and impacts confidentiality and availability.
Potential Impact
Successful exploitation can cause denial of service via application crashes or disclosure of sensitive information from memory adjacent to the buffer. The confidentiality impact is high, and availability impact is high, while integrity is not affected. The attack requires local access with low privileges and user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-5915 for current remediation guidance. No explicit patch or workaround information is provided in the advisory content. Users should monitor the vendor advisory for updates and apply official fixes once available.
CVE-2025-5915: Heap-based Buffer Overflow
Description
A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.
CVSS v3.1
Score 6.6medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in libarchive arises from a heap buffer over-read when the size of a filter block exceeds the LZSS window size. This causes the library to access memory beyond the allocated buffer, potentially resulting in application crashes or leakage of sensitive data. The issue affects Red Hat Enterprise Linux 10. The CVSS vector indicates the attack requires local access with low complexity, privileges, and user interaction, and impacts confidentiality and availability.
Potential Impact
Successful exploitation can cause denial of service via application crashes or disclosure of sensitive information from memory adjacent to the buffer. The confidentiality impact is high, and availability impact is high, while integrity is not affected. The attack requires local access with low privileges and user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-5915 for current remediation guidance. No explicit patch or workaround information is provided in the advisory content. Users should monitor the vendor advisory for updates and apply official fixes once available.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- redhat
- Date Reserved
- 2025-06-09T08:10:36.710Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2025-5915","vendor":"Red Hat"}]
Threat ID: 68487f561b0bd07c3938a57b
Added to database: 06/10/2025, 18:54:14 UTC
Last enriched: 07/02/2026, 21:58:04 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 149
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.