CVE-2025-5916

MediumCVSS 5.6/10Last modified Sep 1, 2026

Description

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2025
Last modified: Sep 1, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-591602.7Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation o CVE-2025-591612.7Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficie CVE-2025-591628.8color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was CVE-2025-591632.1vet is an open source software supply chain security tool. Versions 1.12.4 and below are vulnerable to a DNS rebinding attack due to lack of CVE-2025-59175.0A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and CVE-2025-591719.8Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote CVE-2025-591728.5Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing a CVE-2025-591746.5Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially c CVE-2025-591776.8Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to ex CVE-2025-591784.8Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configurat CVE-2025-59186.6A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potential CVE-2025-591805.1Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker w