CVE-2025-5917: Out-of-bounds Write
A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.
AI Analysis
Technical Summary
This vulnerability in libarchive involves an off-by-one miscalculation during handling of filename prefixes and suffixes, leading to a 1-byte write overflow. Such a memory corruption flaw can cause application instability or crashes. The flaw affects all libarchive versions before 3.8.0. The CVSS v3.1 base score is 2.8, reflecting low severity due to limited impact and required privileges. Red Hat has published an advisory for this issue but no explicit patch link was provided in the input data.
Potential Impact
The vulnerability can cause a 1-byte overflow in memory, which may lead to application crashes or unpredictable behavior. There is no indication of confidentiality or integrity impact, and no known exploits have been reported. The low CVSS score reflects limited impact and the need for local privileges with user interaction to trigger.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-5917 for current remediation guidance. Since no explicit patch link was provided, users should monitor the vendor advisory for updates and apply official fixes once available. Until patched, avoid processing untrusted archives with vulnerable libarchive versions.
CVE-2025-5917: Out-of-bounds Write
Description
A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.
CVSS v3.1
Score 2.8low
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in libarchive involves an off-by-one miscalculation during handling of filename prefixes and suffixes, leading to a 1-byte write overflow. Such a memory corruption flaw can cause application instability or crashes. The flaw affects all libarchive versions before 3.8.0. The CVSS v3.1 base score is 2.8, reflecting low severity due to limited impact and required privileges. Red Hat has published an advisory for this issue but no explicit patch link was provided in the input data.
Potential Impact
The vulnerability can cause a 1-byte overflow in memory, which may lead to application crashes or unpredictable behavior. There is no indication of confidentiality or integrity impact, and no known exploits have been reported. The low CVSS score reflects limited impact and the need for local privileges with user interaction to trigger.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-5917 for current remediation guidance. Since no explicit patch link was provided, users should monitor the vendor advisory for updates and apply official fixes once available. Until patched, avoid processing untrusted archives with vulnerable libarchive versions.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- redhat
- Date Reserved
- 2025-06-09T08:11:04.787Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2025-5917","vendor":"Red Hat"}]
Threat ID: 68487f561b0bd07c3938a587
Added to database: 06/10/2025, 18:54:14 UTC
Last enriched: 07/02/2026, 21:58:12 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 131
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.