« List of all CVEs

CVE-2025-5914

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

Published: 6/9/2025 Last updated: 7/21/2026 Reserved: 6/9/2025

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

CNA assigner: redhat (53f830b8-0a3f-465b-8143-3b8a9948e749) Requested by: n/a

Metrics

Version Score Severity Vector String
3.1 7.8 High CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Opam packages affected (1)

conf-cpio

Products affected (115)

Product Vendor Version
cert-manager operator for Red Hat OpenShift 1.16 Red Hat 1.15.1
cert-manager operator for Red Hat OpenShift 1.16 Red Hat 3MF Consortium lib3mf 2.0.0
Compliance Operator 1 Red Hat < 3.99v
Compliance Operator 1 Red Hat 1.14.1
Compliance Operator 1 Red Hat v2.8.1.1 and before
Compliance Operator 1 Red Hat 1.14.2
Compliance Operator 1 Red Hat 1.15.2
Compliance Operator 1 Red Hat AQT1000, AR8031, AR8035, AR8151, AR9380, CSR8811, CSRA6620, CSRA6640, CSRB31024, IPQ4018, IPQ4028, IPQ4029, IPQ5010, IPQ5018, IPQ6000, IPQ6005, IPQ6010, IPQ6018, IPQ6028, IPQ8064, IPQ8069, IPQ8070, IPQ8070A, IPQ8071, IPQ8071A, IPQ8072, IPQ8072A, IPQ8074, IPQ8074A, IPQ8076, IPQ8076A, IPQ8078, IPQ8078A, IPQ8173, IPQ8174, PM3003A, PM4125, PM456, PM6125, PM6150, PM6150A, PM6150L, PM6250, PM6350, PM640A, PM640L, PM640P, PM660, PM660A, PM660L, PM670, PM670A, PM670L, PM7150A, PM7150L, PM7250, PM7250B, PM8004, PM8005, PM8008, PM8009, PM8150, PM8150A, PM8150B, PM8150C, PM8150L, PM8250, PM8350, PM8350B, PM8350BH, PM8350C, PM855, PM855A, PM855B, PM855L, PM855P, PM8998, PMC1000H, PMC7180, PMD9655, PME605, PMI632, PMI8998, PMK8002, PMK8003, PMK8350, PMM6155AU, PMM8155AU, PMM8195AU, PMM855AU, PMP8074, PMR525, PMR735A, PMR735B, PMX24, PMX50, PMX55, QAT3514, QAT3516, QAT3518, QAT3519, QAT3522, QAT3550, QAT3555, QAT5515, QAT5516, QAT5522, QAT5533, QAT5568, QBT1000, QBT1500, QBT2000, QCA1062, QCA1064, QCA4024, ...[truncated*]
Compliance Operator 1 Red Hat n/a
Compliance Operator 1 Red Hat n/a
Red Hat Discovery 2 Red Hat < 12.3X48-D105
Red Hat Discovery 2 Red Hat < 78.14
Red Hat Insights proxy 1.5 Red Hat < 18.1R3-S7
Red Hat Insights proxy 1.5 Red Hat < 78.14
Red Hat Enterprise Linux 10 Red Hat unspecified
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat various
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat n/a
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat n/a
Red Hat Enterprise Linux 9 Red Hat n/a
Red Hat Enterprise Linux 9 Red Hat < unspecified
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Red Hat <= 9.4.36.v20210114
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Red Hat 10.0.0
Red Hat Enterprise Linux 9.4 Extended Update Support Red Hat 11.0.0
Red Hat Enterprise Linux 6 Red Hat < 20.2R1-S1, 20.2R2
Red Hat Enterprise Linux 8.6 Telecommunications Update Service Red Hat Android kernel
Red Hat Enterprise Linux 6 Red Hat < publication
2008 for 32-bit Systems Service Pack 2 (Core installation)
Red Hat Enterprise Linux 7 Extended Lifecycle Support Red Hat All versions of HCL Notes v11
Red Hat Enterprise Linux 8 Red Hat 2.2.10 and earlier
Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat n/a
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat n/a
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Red Hat >= 2.8.0, < 2.8.0.beta8
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat n/a
Red Hat Enterprise Linux 8.6 Telecommunications Update Service Red Hat n/a
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat < publication
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat < publication
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat < publication
Red Hat Enterprise Linux 9 Red Hat n/a
Red Hat Enterprise Linux 9 Red Hat n/a
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Red Hat < 0.11.1
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Red Hat unspecified
Red Hat Enterprise Linux 9.4 Extended Update Support Red Hat n/a
Red Hat OpenShift sandboxed containers 1.1 Red Hat < publication
Red Hat OpenShift sandboxed containers 1.1 Red Hat < publication
Red Hat OpenShift sandboxed containers 1.1 Red Hat < publication
Red Hat OpenShift sandboxed containers 1.1 Red Hat < publication
Red Hat OpenShift sandboxed containers 1.1 Red Hat < publication
Red Hat OpenShift sandboxed containers 1.1 Red Hat < publication
Red Hat OpenShift sandboxed containers 1.1 Red Hat < publication
Red Hat OpenShift sandboxed containers 1.1 Red Hat < 98.0.4758.80
Red Hat OpenShift sandboxed containers 1.1 Red Hat < 10.0.19042.1288
Red Hat OpenShift sandboxed containers 1.1 Red Hat < publication
Red Hat OpenShift sandboxed containers 1.1 Red Hat < publication
Red Hat OpenShift sandboxed containers 1.1 Red Hat 9.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.11, 9.16.0 -> 9.16.2, and releases 9.17.0 -> 9.17.1 of the 9.17 experimental development branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Preview Edition from 9.9.3-S1 -> 9.11.18-S1
Red Hat OpenShift sandboxed containers 1.1 Red Hat < publication
Red Hat OpenShift sandboxed containers 1.1 Red Hat < 19.2R1-S8, 19.2R3-S2
RHOSS-1.36-RHEL-8 Red Hat < 2011_1_700
RHOSS-1.36-RHEL-8 Red Hat < 6.1.7601.25924
RHOSS-1.36-RHEL-8 Red Hat < 2011_1_710
RHOSS-1.36-RHEL-8 Red Hat < 6.2.9200.23679
RHOSS-1.36-RHEL-8 Red Hat < 2011_1_730
RHOSS-1.36-RHEL-8 Red Hat n/a
RHOSS-1.36-RHEL-8 Red Hat < 2011_1_731
RHOSS-1.36-RHEL-8 Red Hat Supported Preview Branch 9.16-S 9.16.11-S through versions before 9.16.27-S
RHOSS-1.36-RHEL-8 Red Hat < 2011_1_752
RHOSS-1.36-RHEL-8 Red Hat n/a
RHOSS-1.36-RHEL-8 Red Hat < unspecified
RHOSS-1.36-RHEL-8 Red Hat < 2020
RHOSS-1.36-RHEL-8 Red Hat < 101
RHOSS-1.36-RHEL-8 Red Hat < 9.0.12012.0
RHOSS-1.36-RHEL-8 Red Hat n/a
RHOSS-1.36-RHEL-8 Red Hat < 102
RHOSS-1.36-RHEL-8 Red Hat < 103
RHOSS-1.36-RHEL-8 Red Hat 8.0.28 and prior
RHOSS-1.36-RHEL-8 Red Hat < 104
RHOSS-1.36-RHEL-8 Red Hat < 2021
RHOSS-1.36-RHEL-8 Red Hat < 105
RHOSS-1.36-RHEL-8 Red Hat 1.13.6
Red Hat OpenShift Container Platform 4.19 Red Hat <= 2.7.0-beta2
Red Hat OpenShift Container Platform 4.20 Red Hat unspecified
Red Hat OpenShift Container Platform 4.17 Red Hat n/a
Red Hat OpenShift Container Platform 4.16 Red Hat n/a
Red Hat OpenShift Container Platform 4.15 Red Hat 1.0
Red Hat OpenShift Container Platform 4.14 Red Hat < https://aka.ms/OfficeSecurityReleases
Red Hat OpenShift Container Platform 4.14 Red Hat 1.1.3.10
Red Hat OpenShift Container Platform 4.20 Red Hat TRB2_R_00.02.04.01 firmware
Red Hat OpenShift Container Platform 4.19 Red Hat n/a
Red Hat OpenShift Container Platform 4.18 Red Hat n/a
Red Hat OpenShift Container Platform 4.17 Red Hat <= 10.0.0
Red Hat OpenShift Container Platform 4.16 Red Hat n/a
Red Hat OpenShift Container Platform 4.15 Red Hat n/a
Red Hat OpenShift Container Platform 4.18 Red Hat 6.6.604 and below
Red Hat OpenShift distributed tracing 3.5.3 Red Hat < 92
Red Hat OpenShift distributed tracing 3.5.3 Red Hat Workspace ONE Access 20.10.01, 20.10 & 20.01. Identity Manager 3.3.5, 3.3.4, 3.3.3 & 3.3.2.
Red Hat OpenShift distributed tracing 3.5.3 Red Hat openldap 2.4.56
Red Hat OpenShift distributed tracing 3.5.3 Red Hat <= 3.1.17
Red Hat OpenShift distributed tracing 3.5.3 Red Hat 8.5
Red Hat OpenShift distributed tracing 3.5.3 Red Hat 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x
Red Hat OpenShift distributed tracing 3.5.3 Red Hat < publication
Red Hat OpenShift distributed tracing 3.5.3 Red Hat All versions < V2.8.20
Red Hat OpenShift distributed tracing 3.5.3 Red Hat < publication
Red Hat OpenShift distributed tracing 3.5.3 Red Hat < publication
Red Hat OpenShift distributed tracing 3.5.3 Red Hat All versions < V13.2
Red Hat OpenShift distributed tracing 3.5.3 Red Hat < publication
Red Hat OpenShift distributed tracing 3.5.3 Red Hat >= 8.0.0, < 8.0.8
Red Hat OpenShift distributed tracing 3.5.3 Red Hat < publication
Red Hat OpenShift distributed tracing 3.5.3 Red Hat < 4.1.2
Red Hat OpenShift distributed tracing 3.5.3 Red Hat n/a
Red Hat OpenShift distributed tracing 3.5.3 Red Hat < publication
Red Hat Web Terminal 1.11 on RHEL 9 Red Hat unspecified
Red Hat Web Terminal 1.11 on RHEL 9 Red Hat 9.0 and earlier versions
Red Hat Web Terminal 1.11 on RHEL 9 Red Hat < 2.6.0
Red Hat Web Terminal 1.12 on RHEL 9 Red Hat < 2011_1_640
Red Hat Web Terminal 1.11 on RHEL 9 Red Hat < 2011_1_620
Red Hat Web Terminal 1.12 on RHEL 9 Red Hat < 10.0.20348.643

References (68)