CVE-2025-5915

MediumCVSS 6.6/10Last modified Sep 1, 2026

Description

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2025
Last modified: Sep 1, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-591507.5Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versi CVE-2025-591518.2Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi CVE-2025-591527.5Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can be completely bypassed by manipula CVE-2025-591545.9Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication c CVE-2025-591556.9hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants. From 1.4.0 to before 1.5.0, CVE-2025-591568.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Rem CVE-2025-591578.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the G CVE-2025-591588.0Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including CVE-2025-591599.6SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2025-59165.6A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing CVE-2025-591602.7Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation o CVE-2025-591612.7Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficie