CVE-2025-5914

HighCVSS 7.8/10Last modified Nov 6, 2026

Description

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

VendorProductVersions
——< 3.8.0
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat OpenShift Container Platform 4.14—
Red HatRed Hat OpenShift Container Platform 4.15—
Red HatRed Hat OpenShift Container Platform 4.16—
Red HatRed Hat OpenShift Container Platform 4.17—
Red HatRed Hat OpenShift Container Platform 4.18—
Red HatRed Hat OpenShift Container Platform 4.19—
Red HatRed Hat OpenShift Container Platform 4.20—
Red HatRed Hat Web Terminal 1.11 on RHEL 9—
Red HatRed Hat Web Terminal 1.11 on RHEL 9—
Red HatRed Hat Web Terminal 1.12 on RHEL 9—
Red HatRHOSS-1.36-RHEL-8—
Red HatRHOSS-1.36-RHEL-8—
Red HatRHOSS-1.36-RHEL-8—
Red HatRHOSS-1.36-RHEL-8—
Red HatRHOSS-1.36-RHEL-8—
Red HatRHOSS-1.36-RHEL-8—
Red HatRHOSS-1.36-RHEL-8—
Red HatRHOSS-1.36-RHEL-8—
Red HatRHOSS-1.36-RHEL-8—
Red HatRHOSS-1.36-RHEL-8—
Red HatRHOSS-1.36-RHEL-8—
Red Hatcert-manager operator for Red Hat OpenShift 1.16—
Red HatCompliance Operator 1—
Red HatCompliance Operator 1—
Red HatCompliance Operator 1—
Red HatOpenShift File Integrity Operator - FIO 1—
Red HatRed Hat Discovery 2—
Red HatRed Hat Insights proxy 1.5—
Red HatRed Hat OpenShift distributed tracing 3.5.3—
Red HatRed Hat OpenShift distributed tracing 3.5.3—
Red HatRed Hat OpenShift distributed tracing 3.5.3—
Red HatRed Hat OpenShift distributed tracing 3.5.3—
Red HatRed Hat OpenShift distributed tracing 3.5.3—

References

Timeline

Published
Jun 9, 2025
Last modified
Nov 6, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-591408.8backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishinCVE-2025-591418.8simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishiCVE-2025-591428.8color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken oveCVE-2025-591438.8color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was taken over afCVE-2025-591448.8debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. VCVE-2025-591458.8color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attCVE-2025-591468.5New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. An authenticated Server-Side RequesCVE-2025-591477.5Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. VersiCVE-2025-591487.5Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. VersiCVE-2025-591496.2Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In veCVE-2025-59156.6A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter bloCVE-2025-591507.5Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versi
CVE-2025-5914: High severity, CVSS 7.8 | Vulnix