{"id":"CVE-2025-64031","aliases":["EUVD-2025-210902","GHSA-pqgv-phc2-5p8r","RHSA-2026:43818","UBUNTU-CVE-2025-64031"],"status":"published","title":"libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the...","description":"libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)","severity":{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0016,"percentile":0.05266,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-122"],"published":"2026-07-23T10:14:35Z","modified":"2026-10-28T02:30:44Z","affected":[{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bsdcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.8-3.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.8-3.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.8-3.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bsdunzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.8-3.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.8-3.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.8-3.1.hum1"}]}],"bundled":2}],"products":[{"vendor":"libarchive","product":"libarchive"}],"references":[{"url":"https://github.com/libarchive/libarchive/pull/2734","tags":["fix","article","report"]},{"url":"https://github.com/libarchive/libarchive/pull/2734/commits","tags":["web","article","report"]},{"url":"https://github.com/libarchive/libarchive/pull/2734/files","tags":["web","article","report"]},{"url":"https://github.com/libarchive/libarchive/blob/master/libarchive/archive_write_add_filter_gzip.c","tags":["web","article","report"]},{"url":"https://gist.github.com/ttuurrnn/1365a4a9b1c3d5826a3a9bbe111f26b8","tags":["exploit","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64031","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pqgv-phc2-5p8r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64031.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43818","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16517","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-64031","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43818.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532805","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-64031","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2505492","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16517","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16517","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-64031","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-64031","description":"libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-16T14:22:52.108Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:32:46.750177Z"}],"euvd":[{"id":"EUVD-2025-210902","description":"libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-16T14:22:52Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T17:28:16.201278Z"}],"ghsa":[{"id":"GHSA-pqgv-phc2-5p8r","title":"libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the...","description":"libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)","status":"published","published":"2026-09-14T03:30:21Z","modified":"2026-09-14T03:30:29Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:11:47.913221Z"}],"nvd":[{"id":"CVE-2025-64031","description":"libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)","status":"published","published":"2026-09-14T01:16:26.19Z","modified":"2026-10-14T19:10:00.297Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:03.20248Z"}],"osv":[{"id":"CVE-2025-64031","description":"libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-10-28T02:30:44.629044297Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"RHSA-2026:43818","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-23T10:14:35Z","modified":"2026-10-14T10:20:44Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"UBUNTU-CVE-2025-64031","description":"libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)","status":"withdrawn","published":"2026-09-14T01:16:00Z","modified":"2026-10-08T12:53:26.954760458Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:55:52.345622Z"}]}}