# CVE-2025-5914: Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

Status: published. Published: 2025-06-09. Updated: 2026-11-04.

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: secalert@redhat.com) — https://github.com/libarchive/libarchive/pull/2598
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 134c704f-9b21-4f2e-91b3-4a467353bcc0) — https://github.com/libarchive/libarchive/pull/2598

## Affected products and versions

-  /  (libarchive): ≥ 0; < 3.8.0 (affected, semver). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10 (libarchive): ≥ 0:3.7.7-4.el10_0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 Extended Lifecycle Support (libarchive): ≥ 0:3.1.2-14.el7_9.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (libarchive): ≥ 0:3.3.3-6.el8_10; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.2 Advanced Update Support (libarchive): ≥ 0:3.3.2-8.el8_2.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support (libarchive): ≥ 0:3.3.3-1.el8_4.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On (libarchive): ≥ 0:3.3.3-1.el8_4.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support (libarchive): ≥ 0:3.3.3-6.el8_6; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.6 Telecommunications Update Service (libarchive): ≥ 0:3.3.3-6.el8_6; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions (libarchive): ≥ 0:3.3.3-6.el8_6; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service (libarchive): ≥ 0:3.3.3-5.el8_8.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions (libarchive): ≥ 0:3.3.3-5.el8_8.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (libarchive): ≥ 0:3.5.3-6.el9_6; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions (libarchive): ≥ 0:3.5.3-2.el9_0.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (libarchive): ≥ 0:3.5.3-5.el9_2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Support (libarchive): ≥ 0:3.5.3-4.el9_4.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.14 (openshift/ose-rhel-coreos-9): ≥ 414.92.202510211419-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.15 (openshift/ose-rhel-coreos-9): ≥ 415.92.202601271320-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.16 (openshift/ose-rhel-coreos-9): ≥ 416.94.202601071926-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.17 (openshift/ose-rhel-coreos-9): ≥ 417.94.202510112152-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.18 (openshift/ose-rhel-coreos-9): ≥ 418.94.202510230424-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.19 (openshift/ose-rhel-coreos-9): ≥ 4.19.9.6.202510140714-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.20 (openshift/ose-rhel-coreos-9): ≥ 4.20.9.6.202509251656-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Web Terminal 1.11 on RHEL 9 (web-terminal/web-terminal-rhel9-operator): ≥ 1.11-19; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Web Terminal 1.11 on RHEL 9 (web-terminal/web-terminal-tooling-rhel9): ≥ 1.11-8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Web Terminal 1.12 on RHEL 9 (web-terminal/web-terminal-tooling-rhel9): ≥ 1.12-4; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-data-index-ephemeral-rhel8): ≥ 1.36.0-11; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-data-index-postgresql-rhel8): ≥ 1.36.0-11; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-db-migrator-tool-rhel8): ≥ 1.36.0-11; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-jobs-service-ephemeral-rhel8): ≥ 1.36.0-10; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-jobs-service-postgresql-rhel8): ≥ 1.36.0-10; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8): ≥ 1.36.0-4; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-management-console-rhel8): ≥ 1.36.0-9; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-operator-bundle): ≥ 1.36.0-12; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-rhel8-operator): ≥ 1.36.0-18; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-swf-builder-rhel8): ≥ 1.36.0-11; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-swf-devmode-rhel8): ≥ 1.36.0-7; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / cert-manager operator for Red Hat OpenShift 1.16 (cert-manager/jetstack-cert-manager-rhel9): ≥ v1.16.5-1760515757; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Compliance Operator 1 (compliance/openshift-compliance-must-gather-rhel8): ≥ 1.8.0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Compliance Operator 1 (compliance/openshift-compliance-openscap-rhel8): ≥ 1.8.0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Compliance Operator 1 (compliance/openshift-compliance-rhel8-operator): ≥ 1.8.0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / OpenShift File Integrity Operator - FIO 1 (compliance/openshift-file-integrity-rhel8-operator): ≥ v1.3; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Discovery 2 (discovery/discovery-server-rhel9): ≥ 2.2.1-1758555934; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Insights proxy 1.5 (insights-proxy/insights-proxy-container-rhel9): ≥ 1.5.6-1756187445; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift distributed tracing 3.5.3 (rhosdt/jaeger-agent-rhel8): ≥ rhosdt-3.5-1756116455; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift distributed tracing 3.5.3 (rhosdt/jaeger-all-in-one-rhel8): ≥ rhosdt-3.5-1756116482; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift distributed tracing 3.5.3 (rhosdt/jaeger-collector-rhel8): ≥ rhosdt-3.5-1756116441; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift distributed tracing 3.5.3 (rhosdt/jaeger-es-index-cleaner-rhel8): ≥ rhosdt-3.5-1756116449; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift distributed tracing 3.5.3 (rhosdt/jaeger-es-rollover-rhel8): ≥ rhosdt-3.5-1756116439; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift distributed tracing 3.5.3 (rhosdt/jaeger-ingester-rhel8): ≥ rhosdt-3.5-1756116447; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift distributed tracing 3.5.3 (rhosdt/jaeger-operator-bundle): ≥ rhosdt-3.5-1756128595; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift distributed tracing 3.5.3 (rhosdt/jaeger-query-rhel8): ≥ rhosdt-3.5-1756125872; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift distributed tracing 3.5.3 (rhosdt/jaeger-rhel8-operator): ≥ rhosdt-3.5-1756116445; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift sandboxed containers 1.10 (openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9): ≥ 1.10.2-1757422110; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift sandboxed containers 1.10 (openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9): ≥ 1.10.2-1757421846; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift sandboxed containers 1.10 (openshift-sandboxed-containers/osc-monitor-rhel9): ≥ 1.10.2-1757421804; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift sandboxed containers 1.10 (openshift-sandboxed-containers/osc-must-gather-rhel9): ≥ 1.10.2-1757422070; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift sandboxed containers 1.10 (openshift-sandboxed-containers/osc-podvm-builder-rhel9): ≥ 1.10.2-1757421879; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift sandboxed containers 1.10 (openshift-sandboxed-containers/osc-podvm-payload-rhel9): ≥ 1.10.2-1757422401; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift sandboxed containers 1.10 (openshift-sandboxed-containers/osc-rhel9-operator): ≥ 1.10.2-1757421890; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (libarchive): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat
- Siemens / SIDIS Secured SmartPlug: ≥ 0; < V7.26.0310 (affected, custom). Source: ADP: siemens-SADP

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "3.8.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: CNA: redhat

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: NVD: nvd@nist.gov

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.47% as of 2026-11-04; percentile 41.20%

- SSVC: exploitation poc; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-190

## Exploit evidence

- exploit: https://github.com/libarchive/libarchive/pull/2598 (ADP: CISA-ADP)
- exploit: https://github.com/libarchive/libarchive/pull/2598 (secalert@redhat.com)
- exploit: https://github.com/libarchive/libarchive/pull/2598 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

## References

- https://access.redhat.com/errata/RHSA-2025:14130 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:14135 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:14137 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:14141 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:14142 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:14525 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:14528 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:14594 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:14644 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:14808 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:14810 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:14828 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:15024 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:15397 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:15709 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:15827 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:15828 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:16524 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:18217 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:18218 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:18219 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:19041 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:19046 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:21885 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:21913 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:0326 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:0934 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:1541 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2025-5914 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2370861 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://github.com/libarchive/libarchive/pull/2598 (CNA: redhat)

- https://github.com/libarchive/libarchive/releases/tag/v3.8.0 (CNA: redhat)

- https://github.com/libarchive/libarchive/pull/2598 (ADP: CISA-ADP; exploit)

- https://cert-portal.siemens.com/productcert/html/ssa-585531.html (ADP: siemens-SADP)

- https://access.redhat.com/errata/RHSA-2025:14130 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:14135 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:14137 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:14141 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:14142 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:14525 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:14528 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:14594 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:14644 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:14808 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:14810 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:14828 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:15024 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:15397 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:15709 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:15827 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:15828 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:16524 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:18217 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:18218 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:18219 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:19041 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:19046 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:21885 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2025:21913 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2026:0326 (secalert@redhat.com; Third Party Advisory)

- https://access.redhat.com/errata/RHSA-2026:0934 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:1541 (secalert@redhat.com)

- https://access.redhat.com/security/cve/CVE-2025-5914 (secalert@redhat.com; Third Party Advisory)

- https://bugzilla.redhat.com/show_bug.cgi?id=2370861 (secalert@redhat.com; Issue Tracking, Third Party Advisory)

- https://github.com/libarchive/libarchive/pull/2598 (secalert@redhat.com; Exploit, Issue Tracking, Patch)

- https://github.com/libarchive/libarchive/releases/tag/v3.8.0 (secalert@redhat.com; Release Notes)

- https://cert-portal.siemens.com/productcert/html/ssa-585531.html (0b142b55-0307-4c5a-b3c9-f314f3fb7c5e)

- https://github.com/libarchive/libarchive/pull/2598 (134c704f-9b21-4f2e-91b3-4a467353bcc0; Exploit, Issue Tracking, Patch)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2025-5914; retrieved 2026-11-04; source updated 2026-11-04

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-5914; retrieved 2026-11-05; source updated 2026-11-04

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2025-5914; retrieved 2026-11-04; source updated Not reported

Revision: 481618cce697b9e170cb71fd9964c3ba72deab2874e23ffd4d27ecc5704d993a

Canonical: https://y2.dev/cve/CVE-2025-5914

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.