Memory Allocation Vulnerability in libarchive's bsdtar Product
CVE-2025-60753

5.5MEDIUM

Key Information:

Vendor

libarchive

Status
bsdtar
Vendor
CVE Published:
5 November 2025

What is CVE-2025-60753?

A vulnerability exists in libarchive's bsdtar that affects versions prior to 3.8.1. The issue arises in the apply_substitution function within the subst.c file, which processes specifically crafted -s substitution rules. Successful exploitation can trigger unbounded memory allocation, leading to a denial of service situation characterized by an Out-of-Memory (OOM) crash. Users are advised to upgrade to the latest version to mitigate the risk.

References

https://github.com/libarchive/libarchive/issues/2725
https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.