Skip to content
VulniPulse
Sign in
Advisory severityHigh7.8Red Hat Linux

High [CVE-2025-5914] double free at archive_read_format_rar_seek_data in archive_read_support_format_rar.c

This high-severity Red Hat Linux advisory covers CVE-2025-5914 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8.2 Advanced Update Support.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2025-5914 Source published Source updated

VulniPulse record published

CVE-2025-5914
Affected products & platforms
Red Hat LinuxRed Hat Enterprise Linux
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition.

Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

The Red Hat Product Security team has rated this vulnerability as Important because it allows a local attacker with limited privileges to trigger a double-free in libarchive's RAR parser by providing a specially crafted RAR archive. Successful exploitation could result in code execution or application crashes.

Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-190.

Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 28 more.

Affected products named by the advisory: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Telecommunications Update Service; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions; and 24 more.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 22 days ago·verify at source

Fixed versions
  • 3.8.0
  • libarchive-0:3.7.7-4.el10_0
  • libarchive-0:3.1.2-14.el7_9.1
  • libarchive-0:3.3.3-6.el8_10
  • libarchive-0:3.3.2-8.el8_2.1
  • libarchive-0:3.3.3-1.el8_4.1
  • libarchive-0:3.3.3-6.el8_6
  • libarchive-0:3.3.3-5.el8_8.1
  • libarchive-0:3.5.3-6.el9_6
  • libarchive-0:3.5.3-2.el9_0.1
  • libarchive-0:3.5.3-5.el9_2
  • libarchive-0:3.5.3-4.el9_4.1
  • rhcos-414.92.202510211419-0
  • rhcos-415.92.202601271320-0
  • rhcos-416.94.202601071926-0
  • rhcos-417.94.202510112152-0
  • rhcos-418.94.202510230424-0
  • rhcos-4.19.9.6.202510140714-0
  • rhcos-4.20.9.6.202509251656-0
  • web-terminal/web-terminal-rhel9-operator:1.11-19
  • web-terminal/web-terminal-tooling-rhel9:1.11-8
  • web-terminal/web-terminal-tooling-rhel9:1.12-4
  • openshift-serverless-1/logic-data-index-ephemeral-rhel8:1.36.0-11
  • openshift-serverless-1/logic-data-index-postgresql-rhel8:1.36.0-11
  • openshift-serverless-1/logic-db-migrator-tool-rhel8:1.36.0-11
  • openshift-serverless-1/logic-jobs-service-ephemeral-rhel8:1.36.0-10
  • openshift-serverless-1/logic-jobs-service-postgresql-rhel8:1.36.0-10
  • openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8:1.36.0-4
  • openshift-serverless-1/logic-management-console-rhel8:1.36.0-9
  • openshift-serverless-1/logic-operator-bundle:1.36.0-12
  • openshift-serverless-1/logic-rhel8-operator:1.36.0-18
  • openshift-serverless-1/logic-swf-builder-rhel8:1.36.0-11
  • openshift-serverless-1/logic-swf-devmode-rhel8:1.36.0-7
  • cert-manager/jetstack-cert-manager-rhel9:v1.16.5-1760515757
  • compliance/openshift-compliance-must-gather-rhel8:1.8.0
  • compliance/openshift-compliance-openscap-rhel8:1.8.0
  • compliance/openshift-compliance-rhel8-operator:1.8.0
  • compliance/openshift-file-integrity-rhel8-operator:v1.3
  • discovery/discovery-server-rhel9:2.2.1-1758555934
  • insights-proxy/insights-proxy-container-rhel9:1.5.6-1756187445
  • rhosdt/jaeger-agent-rhel8:rhosdt-3.5-1756116455
  • RHSA-2025:14137
  • RHSA-2025:14828
  • RHSA-2025:14135
  • RHSA-2025:14528
  • RHSA-2025:14810
  • RHSA-2025:14808
  • RHSA-2025:14525
  • RHSA-2025:14130
  • RHSA-2025:14141

Official advisory · high-confidence parse· fetched 22 days ago·verify at source

Mitigation

Upgrade to a fixed release: 3.8.0, libarchive-0:3.7.7-4.el10_0, libarchive-0:3.1.2-14.el7_9.1, libarchive-0:3.3.3-6.el8_10, libarchive-0:3.3.2-8.el8_2.1, libarchive-0:3.3.3-1.el8_4.1. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 22 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.