Null Pointer Dereference Vulnerability in libarchive - CVE-2025-1632
Summary
CVE-2025-1632: A vulnerability was found in libarchive up to 3.7.7. Affects libarchive across 2 version ranges.
< 3.7.9-r0
< b439d586f53911c84be5e380445a8a259e19114c
Fixed in 3.7.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a widely used library that provides a flexible and efficient way to read and write various archive formats, including tar, zip, and others. It is commonly utilized in many applications for file compression and decompression tasks. The library is known for its portability and ease of integration into different software projects. However, a vulnerability has been identified in versions up to 3.7.7, which could lead to critical issues if exploited.
Vulnerability Detail
CVE-2025-1632 is a vulnerability found in libarchive that leads to a null pointer dereference in the bsdunzip.c file. This issue arises from improper handling of certain inputs, allowing an attacker to manipulate the function list and potentially crash the application. The vulnerability can be exploited locally, posing a risk to systems using affected versions of the library. The exploit has been publicly disclosed, increasing the urgency for remediation.
How To Fix
Minimum fixed version
3.7.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected functions in bsdunzip.c until the package is updated. Additionally, ensure that your application validates inputs thoroughly to prevent triggering the vulnerability.
Conclusion
The CVE-2025-1632 vulnerability in libarchive poses a significant risk due to its potential to cause application crashes through null pointer dereference. It is crucial for users of the library to update to the latest version to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for libarchive →
FAQ
CVE-2025-1632 is a vulnerability in the libarchive library that can lead to a null pointer dereference, potentially crashing applications that use the library.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without any installation.
Exploiting this vulnerability can lead to application crashes, which may disrupt services and affect user experience.
Yes, a patched version of libarchive is available. It is recommended to update to a version higher than 3.7.7 to mitigate the risk.
Regularly update your dependencies, use tools like Vulert to monitor vulnerabilities, and conduct security audits on your codebase.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
