CVE-2025-25724: libarchive Unchecked Return Value
Vulnerability summary
CVE-2025-25724 is a high (CVSS 7.8) Unchecked Return Value vulnerability in libarchive. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Duplicates 1 · Related 7Timeline
- 02-03-2025PublishedVulnerability first disclosed.
- 04-03-2025Last modifiedVulnerability information updated.
Description
list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
CVSS metrics
8 scores · 8 sources · 1 version- CVE.orgCNA4.0MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated4.0MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated4.0MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated4.0MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
29%
Versus all other CVEs
30-day change
+0.01 pp
From 0.36% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundPocs
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Redhat9 products
- bsdcat-debuginfo< 0:3.5.3-5.el9_4.1 | < 0:3.7.7-3.el10_0 | < 0:3.5.3-5.el9_6
- bsdcpio-debuginfo< 0:3.5.3-5.el9_4.1 | < 0:3.7.7-3.el10_0 | < 0:3.5.3-5.el9_6
- bsdtar< 0:3.5.3-5.el9_4.1 | < 0:3.7.7-3.el10_0 | < 0:3.5.3-5.el9_6
- bsdtar-debuginfo< 0:3.5.3-5.el9_4.1 | < 0:3.7.7-3.el10_0 | < 0:3.5.3-5.el9_6
- bsdunzip-debuginfo< 0:3.7.7-3.el10_0
Suse3 products
- libarchive&distro=SUSE Linux Enterprise Micro 5.3< 3.5.1-150400.3.18.1
- libarchive&distro=SUSE Linux Enterprise Micro 5.4< 3.5.1-150400.3.18.1
- libarchive&distro=SUSE Linux Enterprise Micro 5.5< 3.5.1-150400.3.18.1
Alpine1 product
- libarchive< 3.7.9-r0
Chainguard1 product
- libarchive-dev< 3.7.7-r2
Debian1 product
- libarchiveAll versions (No fix recorded) | < 3.8.4-1
Libarchive1 product
- libarchive≤ 3.7.7
Mageia1 product
- libarchive< 3.6.2-5.4.mga9
Ubuntu1 product
- libarchive< 3.1.2-7ubuntu2.8+esm4 | < 3.1.2-11ubuntu0.16.04.8+esm2 | < 3.2.2-3.1ubuntu0.7+esm2 | < 3.4.0-2ubuntu1.5 | < 3.6.0-1ubuntu1.4 | < 3.7.2-2ubuntu0.4 | < 3.7.7-0ubuntu2.1
Wolfi1 product
- libarchive-dev< 3.7.7-r2
9 vendors · 19 products
References
26 links- github.com/libarchive/libarchive/blob/b439d586f53911c84be5e380445a8a259e19114c/tar/util.cARTICLEREPORTWEBProduct
