CVE-2025-1632

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404 CWE-476

Affected software

Vendor	Product	Versions
n/a	libarchive	3.7.0; 3.7.1; 3.7.2; 3.7.3; 3.7.4; 3.7.5; 3.7.6; 3.7.7

References

https://github.com/Ekkosun/pocs/blob/main/bsdunzip-pocExploit
https://vuldb.com/?ctiid.296619Permissions Required, VDB Entry
https://vuldb.com/?id.296619Permissions Required, VDB Entry
https://vuldb.com/?submit.496460Exploit, Third Party Advisory, VDB Entry
https://github.com/Ekkosun/pocs/blob/main/bsdunzip-pocExploit

Timeline

Published: Feb 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-16347.5A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client r CVE-2025-16356.5Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows a CVE-2025-16366.5Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and CVE-2025-16389.8The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2. This is due CVE-2025-16398.8The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing cap CVE-2025-16409.8A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical. Affected by this issue is some unknown functionality CVE-2025-16419.8A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been classified as critical. This affects an unknown part of the file /AG CVE-2025-16427.5A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the CVE-2025-16438.8A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of CVE-2025-16446.5A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0. Affected is an unknown function of the file /Dado CVE-2025-16456.3A vulnerability classified as critical was found in Benner Connecta 1.0.5330. Affected by this vulnerability is an unknown functionality of CVE-2025-16467.3A vulnerability, which was classified as critical, has been found in Lumsoft ERP 8. Affected by this issue is some unknown functionality of