« List of all CVEs

CVE-2025-5916

Libarchive: integer overflow while reading warc files at archive_read_support_format_warc.c

Published: 6/9/2025 Last updated: 6/30/2026 Reserved: 6/9/2025

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.

CNA assigner: redhat (53f830b8-0a3f-465b-8143-3b8a9948e749) Requested by: n/a

Metrics

Version Score Severity Vector String
3.1 3.9 Low CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

Opam packages affected (1)

conf-cpio

Products affected (14)

Product Vendor Version
< 12.1.1.3
Red Hat Enterprise Linux 10 Red Hat >=13.6, <14.1.7
Red Hat Enterprise Linux 6 Red Hat >=14.2, <14.2.5
Red Hat Enterprise Linux 7 Red Hat >=14.3, <14.3.1
Red Hat Enterprise Linux 8 Red Hat < RELEASE.2021-03-04T00-53-13Z
Red Hat Enterprise Linux 9 Red Hat 2.9.0
Red Hat Enterprise Linux 8 Red Hat FortiOS 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below. FortiProxy 2.0.1 and below, 1.2.9 and below
Red Hat Enterprise Linux 9 Red Hat < 1.6.0
8.0.21 and prior
Red Hat Enterprise Linux 10 Red Hat < 7.0.6
Red Hat Enterprise Linux 6 Red Hat < 7.1.2
Red Hat Enterprise Linux 7 Red Hat Fixed in 5.1.1
Red Hat OpenShift Container Platform 4 Red Hat 2.9.1
Red Hat OpenShift Container Platform 4 Red Hat n/a

References (8)