Critical Vulnerability in libarchive: Double Free Issue in RAR Format Handling
Summary
RLSA-2025:14137: Important: libarchive security update. Affects libarchive versions < 0:3.7.7-4.el10_0. Fixed in 0:3.7.7-4.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a versatile programming library that enables the creation and reading of various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in tools like bsdtar, language bindings such as python-libarchive, and numerous desktop file managers. This library's functionality is crucial for managing file archives efficiently, but it is not without its vulnerabilities.
Vulnerability Detail
The vulnerability identified as CVE-2025-5914 is a double free issue located in the archive_read_format_rar_seek_data() function within the archive_read_support_format_rar.c file. This flaw can lead to potential exploitation, allowing attackers to manipulate memory management, which may result in arbitrary code execution or application crashes. The severity of this vulnerability is underscored by its CVSS score of 7.3, indicating a high level of risk to systems utilizing affected versions of libarchive.
How To Fix
Minimum fixed version
0:3.7.7-4.el10_0
This is the first release that contains the fix.
sudo dnf update libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider disabling the use of RAR format archives until the patch is applied. This can help mitigate the risk of exploitation while a permanent fix is being implemented.
Conclusion
The libarchive library, while essential for managing various archive formats, has a critical vulnerability (CVE-2025-5914) that requires immediate attention. Users are advised to update to the patched version to mitigate risks associated with this flaw. For those unable to update right away, disabling RAR format usage is recommended as a temporary measure.
See every vulnerability recorded for libarchive →
FAQ
CVE-2025-5914 is a vulnerability in the libarchive library that allows for a double free condition, potentially leading to memory corruption and arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application crashes or arbitrary code execution, posing significant security risks to affected systems.
If an immediate update is not possible, consider disabling the use of RAR format archives as a temporary workaround to reduce the risk of exploitation.
The libarchive library is maintained by the Rocky Enterprise Software Foundation and Red Hat, who provide updates and security patches.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
