Description
A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.
Affected products
libarchive: libarchive; redhat: openshift container platform; redhat: enterprise linux
References4
- access.redhat.com/security/cve/CVE-2025-5918 Vendor Advisory
- github.com/libarchive/libarchive/pull/2584 Patch
- bugzilla.redhat.com/show_bug.cgi?id=2370877 Issue Tracking
- github.com/libarchive/libarchive/releases/tag/v3.8.0 Release Notes
Metrics
- CVSS 3.1
-
6.6
MEDIUM
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H - EPSS — exploit probability
- 0% percentile: 34 · as of 7 November 2026
- CWE
- CWE-125
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.