Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

Summary

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

Timeline

1. Jun 9, 2025, 7:53 PM UTCCVE published
2. Jun 10, 2025, 3:14 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: partial

3. Oct 12, 2026, 7:53 PM UTCRecord last updated

Affected versions

• libarchive

  fixed in 3.8.0

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• libarchive

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• web-terminal/web-terminal-rhel9-operator

  Version range not reported

• web-terminal/web-terminal-tooling-rhel9

  Version range not reported

• web-terminal/web-terminal-tooling-rhel9

  Version range not reported

• openshift-serverless-1/logic-data-index-ephemeral-rhel8

  Version range not reported

• openshift-serverless-1/logic-data-index-postgresql-rhel8

  Version range not reported

• openshift-serverless-1/logic-db-migrator-tool-rhel8

  Version range not reported

• openshift-serverless-1/logic-jobs-service-ephemeral-rhel8

  Version range not reported

• openshift-serverless-1/logic-jobs-service-postgresql-rhel8

  Version range not reported

• openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8

  Version range not reported

• openshift-serverless-1/logic-management-console-rhel8

  Version range not reported

• openshift-serverless-1/logic-operator-bundle

  Version range not reported

• openshift-serverless-1/logic-rhel8-operator

  Version range not reported

• openshift-serverless-1/logic-swf-builder-rhel8

  Version range not reported

• openshift-serverless-1/logic-swf-devmode-rhel8

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• compliance/openshift-compliance-must-gather-rhel8

  Version range not reported

• compliance/openshift-compliance-openscap-rhel8

  Version range not reported

• compliance/openshift-compliance-rhel8-operator

  Version range not reported

• compliance/openshift-file-integrity-rhel8-operator

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• insights-proxy/insights-proxy-container-rhel9

  Version range not reported

• rhosdt/jaeger-agent-rhel8

  Version range not reported

• rhosdt/jaeger-all-in-one-rhel8

  Version range not reported

• rhosdt/jaeger-collector-rhel8

  Version range not reported

• rhosdt/jaeger-es-index-cleaner-rhel8

  Version range not reported

• rhosdt/jaeger-es-rollover-rhel8

  Version range not reported

• rhosdt/jaeger-ingester-rhel8

  Version range not reported

• rhosdt/jaeger-operator-bundle

  Version range not reported

• rhosdt/jaeger-query-rhel8

  Version range not reported

• rhosdt/jaeger-rhel8-operator

  Version range not reported

• openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9

  Version range not reported

• openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9

  Version range not reported

• openshift-sandboxed-containers/osc-monitor-rhel9

  Version range not reported

• openshift-sandboxed-containers/osc-must-gather-rhel9

  Version range not reported

• openshift-sandboxed-containers/osc-podvm-builder-rhel9

  Version range not reported

• openshift-sandboxed-containers/osc-podvm-payload-rhel9

  Version range not reported

• openshift-sandboxed-containers/osc-rhel9-operator

  Version range not reported

• libarchive

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

References 25