CVE-2025-5916

NameCVE-2025-5916
DescriptionA vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1107623

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libarchive (PTS)bullseye3.4.3-2+deb11u1vulnerable
bullseye (security)3.4.3-2+deb11u2vulnerable
bookworm3.6.2-1+deb12u3fixed
bookworm (security)3.6.2-1+deb12u2vulnerable
forky, sid, trixie3.7.4-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libarchivesourcebookworm3.6.2-1+deb12u3
libarchivesource(unstable)3.7.4-41107623

Notes

[bullseye] - libarchive <postponed> (Minor issue)
https://github.com/libarchive/libarchive/pull/2568
Fixed by: https://github.com/libarchive/libarchive/commit/ef093729521fcf73fa4007d5ae77adfe4df42403 (v3.8.0)

Search for package or bug name: Reporting problems