CVE-2025-5915

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.

This vulnerability is rated Low for Red Hat products. The heap buffer over-read in libarchive occurs when processing specially crafted RAR archives. Exploitation requires user interaction, such as opening a malicious RAR file, which could lead to application crashes or information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to libarchive version 3.8.0 or later, which includes important security fixes and stability improvements.