The vulnerability (CVE-2025-60753) exists in libarchive's bsdtar apply_substitution() function, where crafted -s substitution rules with the global /g flag or empty patterns can repeatedly match zero-length substrings without advancing the input pointer. This causes unbounded output allocation and eventually an out-of-memory condition, resulting in a denial of service by process termination. The impact is limited to availability and requires user interaction and specific conditions to exploit. Red Hat classifies this as a moderate severity issue due to limited impact and uncommon exploitation scenarios. The advisory includes updates to libarchive RPMs (version 3.8.7-1.hum1) for Red Hat Hardened Images to fix this and other related issues. No known exploits in the wild have been reported.

The vulnerability causes denial of service through resource exhaustion (memory) when a crafted substitution rule is used with bsdtar. It does not lead to memory corruption, arbitrary code execution, or privilege escalation. Exploitation requires user interaction and the ability to supply or influence command-line arguments to bsdtar, which is uncommon in most environments. The impact is limited to process availability (crash due to out-of-memory).

A fix is available via the updated libarchive packages (version 3.8.7-1.hum1) included in the Red Hat Hardened Images RPM update. Users should apply this update to remediate the vulnerability. No alternative mitigations meeting Red Hat's standards are currently available. Since exploitation requires specific user interaction and conditions, risk is limited until the update is applied.