CVE record · CVE-2025-5914

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

CVSS 7.8 HighEPSS 0.0049 · 42nd percentile

Published by the CVE Program (CNA: redhat) at 9 Jun 2025, 19:53 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Not given	Not given Package name: libarchive https://github.com/libarchive/libarchive/	affected before 3.8.0 semver Other versions: unaffected
Red Hat	Red Hat Enterprise Linux 10 Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.7.7-4.el10_0 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.2-14.el7_9.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.3.3-6.el8_10 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.3.2-8.el8_2.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.3.3-1.el8_4.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.3.3-1.el8_4.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.3.3-6.el8_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.3.3-6.el8_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.3.3-6.el8_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.3.3-5.el8_8.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.3.3-5.el8_8.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.5.3-6.el9_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.5.3-6.el9_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.5.3-2.el9_0.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.5.3-5.el9_2 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support Package name: libarchive https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.5.3-4.el9_4.1 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.14 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 414.92.202510211419-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.15 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 415.92.202601271320-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.16 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 416.94.202601071926-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.17 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 417.94.202510112152-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.18 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 418.94.202510230424-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.19 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 4.19.9.6.202510140714-0 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift Container Platform 4.20 Package name: openshift/ose-rhel-coreos-9 https://access.redhat.com/downloads/content/package-browser/	unaffected 4.20.9.6.202509251656-0 to before * rpm Other versions: affected
Red Hat	Red Hat Web Terminal 1.11 on RHEL 9 Package name: web-terminal/web-terminal-rhel9-operator https://catalog.redhat.com/software/containers/	unaffected 1.11-19 to before * rpm Other versions: affected
Red Hat	Red Hat Web Terminal 1.11 on RHEL 9 Package name: web-terminal/web-terminal-tooling-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1.11-8 to before * rpm Other versions: affected
Red Hat	Red Hat Web Terminal 1.12 on RHEL 9 Package name: web-terminal/web-terminal-tooling-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1.12-4 to before * rpm Other versions: affected
Red Hat	RHOSS-1.36-RHEL-8 Package name: openshift-serverless-1/logic-data-index-ephemeral-rhel8 https://catalog.redhat.com/software/containers/	unaffected 1.36.0-11 to before * rpm Other versions: affected
Red Hat	RHOSS-1.36-RHEL-8 Package name: openshift-serverless-1/logic-data-index-postgresql-rhel8 https://catalog.redhat.com/software/containers/	unaffected 1.36.0-11 to before * rpm Other versions: affected
Red Hat	RHOSS-1.36-RHEL-8 Package name: openshift-serverless-1/logic-db-migrator-tool-rhel8 https://catalog.redhat.com/software/containers/	unaffected 1.36.0-11 to before * rpm Other versions: affected
Red Hat	RHOSS-1.36-RHEL-8 Package name: openshift-serverless-1/logic-jobs-service-ephemeral-rhel8 https://catalog.redhat.com/software/containers/	unaffected 1.36.0-10 to before * rpm Other versions: affected
Red Hat	RHOSS-1.36-RHEL-8 Package name: openshift-serverless-1/logic-jobs-service-postgresql-rhel8 https://catalog.redhat.com/software/containers/	unaffected 1.36.0-10 to before * rpm Other versions: affected
Red Hat	RHOSS-1.36-RHEL-8 Package name: openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8 https://catalog.redhat.com/software/containers/	unaffected 1.36.0-4 to before * rpm Other versions: affected
Red Hat	RHOSS-1.36-RHEL-8 Package name: openshift-serverless-1/logic-management-console-rhel8 https://catalog.redhat.com/software/containers/	unaffected 1.36.0-9 to before * rpm Other versions: affected
Red Hat	RHOSS-1.36-RHEL-8 Package name: openshift-serverless-1/logic-operator-bundle https://catalog.redhat.com/software/containers/	unaffected 1.36.0-12 to before * rpm Other versions: affected
Red Hat	RHOSS-1.36-RHEL-8 Package name: openshift-serverless-1/logic-rhel8-operator https://catalog.redhat.com/software/containers/	unaffected 1.36.0-18 to before * rpm Other versions: affected
Red Hat	RHOSS-1.36-RHEL-8 Package name: openshift-serverless-1/logic-swf-builder-rhel8 https://catalog.redhat.com/software/containers/	unaffected 1.36.0-11 to before * rpm Other versions: affected
Red Hat	RHOSS-1.36-RHEL-8 Package name: openshift-serverless-1/logic-swf-devmode-rhel8 https://catalog.redhat.com/software/containers/	unaffected 1.36.0-7 to before * rpm Other versions: affected
Red Hat	cert-manager operator for Red Hat OpenShift 1.16 Package name: cert-manager/jetstack-cert-manager-rhel9 https://catalog.redhat.com/software/containers/	unaffected v1.16.5-1760515757 to before * rpm Other versions: affected
Red Hat	OpenShift Compliance Operator 1 Package name: compliance/openshift-compliance-must-gather-rhel8 https://catalog.redhat.com/software/containers/	unaffected 1.8.0 to before * rpm Other versions: affected

And 23 more products. The full list is on the CVE record.

Identifiers: CVE-2025-5914
CNA: redhat
Weakness (CWE): CWE-190
Tags: Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.2 Advanced Update Support
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Memory corruption
Published: 9 Jun 2025
Updated: 6 Nov 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.8	High	3.1	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	CNA (redhat)

CISA KEV Not listed.
EPSS 0.0049, the 42nd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

9 Jun 2025, 19:53 UTC Confirmed by the CVE List
9 Jun 2025, 20:15 UTC Confirmed by NVD

Sources

References from the CNA

access.redhat.com/errata/RHSA-2025:14130 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:14135 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:14137 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:14141 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:14142 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:14525 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:14528 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:14594 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:14644 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:14808 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:14810 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:14828 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:15024 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:15397 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:15709 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:15827 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:15828 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:16524 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:18217 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:18218 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:18219 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:19041 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:19046 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:21885 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:21913 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:0326 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:0934 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:1541 vendor-advisoryredhat
access.redhat.com/security/cve/CVE-2025-5914 vdb-entryredhat
bugzilla.redhat.com/show_bug.cgi?id=2370861 issue-trackingredhat

And 2 more on the CVE record.

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.