CVE-2025-5914: Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c
Description
A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.
Classification
CVE ID: CVE-2025-5914
Problem Types
Double FreeAffected Products
Vendor: Red Hat
Product: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.01% (probability of being exploited)
EPSS Percentile: 1.33% (scored less or equal to compared to others)
EPSS Date: 2025-06-14 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-5914https://access.redhat.com/security/cve/CVE-2025-5914
https://bugzilla.redhat.com/show_bug.cgi?id=2370861
https://github.com/libarchive/libarchive/pull/2598
https://github.com/libarchive/libarchive/releases/tag/v3.8.0