CVE-2025-1632

A flaw was found in the bsdunzip utility of libarchive. In affected versions, a specially crafted file may trigger a null pointer dereference. This issue can lead to an application crash or other unexpected behavior. This bug does not compromise the integrity or availability of the base system.

This vulnerability is rated as having a Low impact because successful exploitation only results in a localized application crash during archive inspection, causing minimal denial of service without compromising system confidentiality or integrity. On Red Hat Enterprise Linux and container environments, bsdunzip operates as an ephemeral command-line tool rather than a persistent network service, restricting the blast radius solely to the active process. Triggering this flaw requires a user or script to deliberately process a specially crafted archive file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.