Description
A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | libarchive | 3.7.0, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.6, 3.7.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libarchive | 3.7.4-2 | — |
| Debian 13 | libarchive | 3.7.4-2 | — |
| Debian 12 | libarchive | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | libarchive | 3.7.2-2ubuntu0.4 | USN-7454-1 |
| Ubuntu 22.04 LTS | libarchive | 3.6.0-1ubuntu1.4 | USN-7454-1 |
| Ubuntu 20.04 LTS | libarchive | 3.4.0-2ubuntu1.5 | USN-7454-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | libarchive | 3.7.2-150600.3.12.1 | SUSE-SU-2025:0985-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | libarchive | 3.7.4-slfo.1.1_2.1 | SUSE-SU-2025:20257-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libarchive | 3.7.7-3.1 | openSUSE-SU-2025:14882-1 |
| openSUSE Leap 15.6 | libarchive | 3.7.2-150600.3.12.1 | SUSE-SU-2025:0985-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libarchive | 3.7.9-r0 | — |
| Alpine v3.23 | libarchive | 3.7.9-r0 | — |
| Alpine v3.22 | libarchive | 3.7.9-r0 | — |
| Alpine v3.21 | libarchive | 3.7.9-r0 | — |
| Alpine v3.20 | libarchive | 3.7.9-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | libarchive | 3.7.9-r0 | — |
| Alpine v3.18 | libarchive | 3.7.9-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libarchive | 3.7.7-2 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | libarchive | 3.7.7-r2 | — |
Advisories 6
- USN-7454-1 libarchive vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2025:20257-1 Security update for libarchive SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:0985-1 Security update for libarchive SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14882-1 bsdtar-3.7.7-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1850 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Nov 17, 2025
- WID-SEC-2025-0432 libarchive: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jun 3, 2025
References
- VDB-296619 | libarchive bsdunzip.c list null pointer dereference vdb-entry technical-description
- VDB-296619 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #496460 | libarchive bsdunzip 3.77 NULL Pointer Dereference third-party-advisory
- https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc exploit