Description
A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | libarchive | < 3.8.0 | 3.8.0 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libarchive | 3.8.4-1 | — |
| Debian 13 | libarchive | 3.7.4-4+deb13u1 | — |
| Debian 12 | libarchive | 3.6.2-1+deb12u4 | — |
| Debian 11 | libarchive | 3.4.3-2+deb11u3 | DLA-4368-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | libarchive | 3.7.7-0ubuntu3.1 | — |
| Ubuntu 24.04 LTS | libarchive | 3.7.2-2ubuntu0.6 | — |
| Ubuntu 22.04 LTS | libarchive | 3.6.0-1ubuntu1.6 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libarchive | 3.4.0-2ubuntu1.5+esm1 | — |
| Ubuntu Pro 18.04 LTS | libarchive | 3.2.2-3.1ubuntu0.7+esm2 | — |
| Ubuntu Pro 16.04 LTS | libarchive | 3.1.2-11ubuntu0.16.04.8+esm2 | — |
| Ubuntu Pro 14.04 LTS | libarchive | 3.1.2-7ubuntu2.8+esm4 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libarchive | 3.7.2-150600.3.17.1 | SUSE-SU-2025:02566-1 |
| SLES 15 SP6 | libarchive | 3.7.2-150600.3.17.1 | SUSE-SU-2025:02566-1 |
| SLES 15 SP5 | libarchive | 3.5.1-150400.3.21.1 | SUSE-SU-2025:02718-2 |
| SLES 15 SP4 | libarchive | 3.5.1-150400.3.21.1 | SUSE-SU-2025:02718-2 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | libarchive | 3.5.1-150400.3.21.1 | SUSE-SU-2025:02718-2 |
| SLES for SAP 15 SP4 | libarchive | 3.5.1-150400.3.21.1 | SUSE-SU-2025:02718-2 |
| SLE Micro 6.1 | libarchive | 3.7.4-slfo.1.1_3.1 | SUSE-SU-2025:20594-1 |
| SLE Micro 6.0 | libarchive | 3.6.2-5.1 | SUSE-SU-2025:20560-1 |
| SLE Micro 5.5 | libarchive | 3.5.1-150400.3.21.1 | SUSE-SU-2025:02718-1 |
| SLE Micro 5.4 | libarchive | 3.5.1-150400.3.21.1 | SUSE-SU-2025:02718-1 |
| SLE Micro 5.3 | libarchive | 3.5.1-150400.3.21.1 | SUSE-SU-2025:02718-1 |
| SLE HPC 15 SP5 | libarchive | 3.5.1-150400.3.21.1 | SUSE-SU-2025:02718-2 |
| SLE HPC 15 SP4 | libarchive | 3.5.1-150400.3.21.1 | SUSE-SU-2025:02718-2 |
| SUSE Manager Server LTS 4.3 | libarchive | 3.5.1-150400.3.21.1 | SUSE-SU-2025:02718-2 |
| SUSE Manager Proxy LTS 4.3 | libarchive | 3.5.1-150400.3.21.1 | SUSE-SU-2025:02718-2 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | libarchive | 3.7.2-150600.3.17.1 | SUSE-SU-2025:02566-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cmake | 3.30.3-8 | — |
| Azure Linux 3 | libarchive | 3.7.7-3 | — |
| Azure Linux 2 (CBL-Mariner) | cmake | 3.21.4-20 | — |
| Azure Linux 2 (CBL-Mariner) | libarchive | 3.6.1-7 | — |
Advisories 11
- WID-SEC-2025-1266 libarchive: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jun 28, 2026
- SUSE-SU-2025:20594-1 Security update for libarchive SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20560-1 Security update for libarchive SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02718-2 Security update for libarchive SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-2836 Apple iOS und iPadOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 11, 2026
- SUSE-SU-2025:02718-1 Security update for libarchive SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02566-1 Security update for libarchive SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-2838 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 17, 2025
- NCSC-2025-0397 Kwetsbaarheden verholpen in Apple iOS en iPadOS NCSC-NL (Netherlands) · Dec 15, 2025
- NCSC-2025-0396 Kwetsbaarheden verholpen in Apple macOS NCSC-NL (Netherlands) · Dec 15, 2025
- DLA-4368-1 libarchive - security update Debian Security (DSA / DLA) · Nov 11, 2025