CVE-2025-5918

MediumCVSS 6.6/10Last modified Sep 1, 2026

Description

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Jun 9, 2025
Last modified
Sep 1, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-591805.1Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker wCVE-2025-591814.8Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that coCVE-2025-591845.5Exposure of sensitive information to an unauthorized actor in Windows High Availability Services allows an authorized attacker to disclose iCVE-2025-591856.5External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.CVE-2025-591865.5Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2025-591877.8Improper input validation in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-591885.5Exposure of sensitive information to an unauthorized actor in Windows Failover Cluster allows an authorized attacker to disclose informationCVE-2025-591897.0Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.CVE-2025-59196.5The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modificatCVE-2025-591905.5Improper input validation in Microsoft Windows Search Component allows an unauthorized attacker to deny service locally.CVE-2025-591917.8Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.CVE-2025-591927.8Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally.
CVE-2025-5918: Medium severity, CVSS 6.6 | Vulnix