Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-5914

CVE-2025-5914HIGH

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  U  H  H  H    7.8   .0044   36.3     —

AFFECTED
  Product                                                                Versions     Fixed
  libarchive                                                             unspecified  —
  Red Hat Enterprise Linux 10                                            unspecified  0:3.7.7-4.el10_0
  Red Hat Enterprise Linux 7 Extended Lifecycle Support                  unspecified  0:3.1.2-14.el7_9.1
  Red Hat Enterprise Linux 8                                             unspecified  0:3.3.3-6.el8_10
  Red Hat Enterprise Linux 8.2 Advanced Update Support                   unspecified  0:3.3.2-8.el8_2.1
  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support  unspecified  0:3.3.3-1.el8_4.1
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On  unspecified  0:3.3.3-1.el8_4.1
  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support  unspecified  0:3.3.3-6.el8_6
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service         unspecified  0:3.3.3-6.el8_6
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions         unspecified  0:3.3.3-6.el8_6
  + 53 more

TIMELINE
  Jun 9   Reserved by redhat
  Jun 9   Published (CNA: redhat)
  Aug 23  EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
  Aug 25  EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
  Aug 31  EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
  Sep 1   EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
  Sep 6   EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
  Sep 7   EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
  Sep 9   EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
  Sep 21  EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.

CWE-190 · CNA: redhat · CVSS v3.1 · 33 references · NVD status: Modified

Description

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

Lifecycle

Complete event history — 10 events, chronological
Date	Event	Detail
June 9, 2025	Reserved	Reserved by redhat
June 9, 2025	Published	Published (CNA: redhat)
August 23, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
August 25, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
August 31, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
September 1, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
September 6, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
September 7, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
September 9, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.
September 21, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.

Affected

Affected products and packages — 63 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
—	libarchive	—	—	—
Red Hat	Red Hat Enterprise Linux 10	—	—	0:3.7.7-4.el10_0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	—	—	0:3.1.2-14.el7_9.1
Red Hat	Red Hat Enterprise Linux 8	—	—	0:3.3.3-6.el8_10
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	—	—	0:3.3.2-8.el8_2.1
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	—	—	0:3.3.3-1.el8_4.1
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	—	—	0:3.3.3-1.el8_4.1
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	—	—	0:3.3.3-6.el8_6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	—	—	0:3.3.3-6.el8_6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	—	—	0:3.3.3-6.el8_6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	—	—	0:3.3.3-5.el8_8.1
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	—	—	0:3.3.3-5.el8_8.1
Red Hat	Red Hat Enterprise Linux 9	—	—	0:3.5.3-6.el9_6
Red Hat	Red Hat Enterprise Linux 9	—	—	0:3.5.3-6.el9_6
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	—	—	0:3.5.3-2.el9_0.1
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	—	—	0:3.5.3-5.el9_2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	—	—	0:3.5.3-4.el9_4.1
Red Hat	Red Hat OpenShift Container Platform 4.14	—	—	414.92.202510211419-0
Red Hat	Red Hat OpenShift Container Platform 4.15	—	—	415.92.202601271320-0
Red Hat	Red Hat OpenShift Container Platform 4.16	—	—	416.94.202601071926-0
Red Hat	Red Hat OpenShift Container Platform 4.17	—	—	417.94.202510112152-0
Red Hat	Red Hat OpenShift Container Platform 4.18	—	—	418.94.202510230424-0
Red Hat	Red Hat OpenShift Container Platform 4.19	—	—	4.19.9.6.202510140714-0
Red Hat	Red Hat OpenShift Container Platform 4.20	—	—	4.20.9.6.202509251656-0
Red Hat	Red Hat Web Terminal 1.11 on RHEL 9	—	—	1.11-19
Red Hat	Red Hat Web Terminal 1.11 on RHEL 9	—	—	1.11-8
Red Hat	Red Hat Web Terminal 1.12 on RHEL 9	—	—	1.12-4
Red Hat	RHOSS-1.36-RHEL-8	—	—	1.36.0-11
Red Hat	RHOSS-1.36-RHEL-8	—	—	1.36.0-11
Red Hat	RHOSS-1.36-RHEL-8	—	—	1.36.0-11
Red Hat	RHOSS-1.36-RHEL-8	—	—	1.36.0-10
Red Hat	RHOSS-1.36-RHEL-8	—	—	1.36.0-10
Red Hat	RHOSS-1.36-RHEL-8	—	—	1.36.0-4
Red Hat	RHOSS-1.36-RHEL-8	—	—	1.36.0-9
Red Hat	RHOSS-1.36-RHEL-8	—	—	1.36.0-12
Red Hat	RHOSS-1.36-RHEL-8	—	—	1.36.0-18
Red Hat	RHOSS-1.36-RHEL-8	—	—	1.36.0-11
Red Hat	RHOSS-1.36-RHEL-8	—	—	1.36.0-7
Red Hat	cert-manager operator for Red Hat OpenShift 1.16	—	—	v1.16.5-1760515757
Red Hat	OpenShift Compliance Operator 1	—	—	1.8.0
Red Hat	OpenShift Compliance Operator 1	—	—	1.8.0
Red Hat	OpenShift Compliance Operator 1	—	—	1.8.0
Red Hat	OpenShift File Integrity Operator - FIO 1	—	—	v1.3
Red Hat	Red Hat Discovery 2	—	—	2.2.1-1758555934
Red Hat	Red Hat Insights proxy 1.5	—	—	1.5.6-1756187445
Red Hat	Red Hat OpenShift distributed tracing 3.5.3	—	—	rhosdt-3.5-1756116455
Red Hat	Red Hat OpenShift distributed tracing 3.5.3	—	—	rhosdt-3.5-1756116482
Red Hat	Red Hat OpenShift distributed tracing 3.5.3	—	—	rhosdt-3.5-1756116441
Red Hat	Red Hat OpenShift distributed tracing 3.5.3	—	—	rhosdt-3.5-1756116449
Red Hat	Red Hat OpenShift distributed tracing 3.5.3	—	—	rhosdt-3.5-1756116439
Red Hat	Red Hat OpenShift distributed tracing 3.5.3	—	—	rhosdt-3.5-1756116447
Red Hat	Red Hat OpenShift distributed tracing 3.5.3	—	—	rhosdt-3.5-1756128595
Red Hat	Red Hat OpenShift distributed tracing 3.5.3	—	—	rhosdt-3.5-1756125872
Red Hat	Red Hat OpenShift distributed tracing 3.5.3	—	—	rhosdt-3.5-1756116445
Red Hat	Red Hat OpenShift sandboxed containers 1.1	—	—	1.10.2-1757422110
Red Hat	Red Hat OpenShift sandboxed containers 1.1	—	—	1.10.2-1757421846
Red Hat	Red Hat OpenShift sandboxed containers 1.1	—	—	1.10.2-1757421804
Red Hat	Red Hat OpenShift sandboxed containers 1.1	—	—	1.10.2-1757422070
Red Hat	Red Hat OpenShift sandboxed containers 1.1	—	—	1.10.2-1757421879
Red Hat	Red Hat OpenShift sandboxed containers 1.1	—	—	1.10.2-1757422401
Red Hat	Red Hat OpenShift sandboxed containers 1.1	—	—	1.10.2-1757421890
Red Hat	Red Hat Enterprise Linux 6	—	—	—
Red Hat	Red Hat OpenShift Container Platform 4	—	—	—

Weaknesses

CWE-190

References (33)

https://access.redhat.com/errata/RHSA-2025:14130 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:14135 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:14137 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:14141 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:14142 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:14525 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:14528 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:14594 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:14644 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:14808 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:14810 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:14828 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:15024 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:15397 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:15709 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:15827 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:15828 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:16524 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:18217 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:18218 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:18219 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:19041 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:19046 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:21885 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2025:21913 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:0326 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:0934
https://access.redhat.com/errata/RHSA-2026:1541
https://access.redhat.com/security/cve/CVE-2025-5914 [Third Party Advisory]
https://bugzilla.redhat.com/show_bug.cgi?id=2370861 [Issue Tracking, Third Party Advisory]
https://cert-portal.siemens.com/productcert/html/ssa-585531.html
https://github.com/libarchive/libarchive/pull/2598 [Exploit, Issue Tracking, Patch]
https://github.com/libarchive/libarchive/releases/tag/v3.8.0 [Release Notes]

Authoritative record: CVE-2025-5914 at cve.org

Vendors: red hat

Weaknesses: CWE-190

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-5914 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.