CVE-2025-5916

Publication date 9 June 2025

Last updated 26 June 2025

Ubuntu priority

Cvss 3 Severity Score

Description

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libarchive	25.10 questing	Fixed 3.7.7-0ubuntu3
	25.04 plucky	Fixed 3.7.7-0ubuntu2.3
	24.10 oracular	Fixed 3.7.4-1ubuntu0.3
	24.04 LTS noble	Fixed 3.7.2-2ubuntu0.5
	22.04 LTS jammy	Fixed 3.6.0-1ubuntu1.5
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
	14.04 LTS trusty	Needs evaluation

Severity score breakdown

Parameter	Value
Base score	3.9 · Low
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	Required
Scope	Unchanged
Confidentiality	Low
Integrity impact	None
Availability impact	Low
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

References

Related Ubuntu Security Notices (USN)

USN-7601-1
libarchive vulnerabilities
26 June 2025