CVE-2025-64031

Katalog CVE

CVSS 2.5 · Low EPSS 0,18%

Kerentanan Heap-based Buffer Overflow. Skor CVSS 3.1 2.5 (Low) menurut mitre.org.

Deskripsi (NVD)

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)

Rincian

Terbit di NVD

14 September 2026

Terakhir diubah

22 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

2.5 (Low), sumber mitre.org
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://gist.github.com/ttuurrnn/1365a4a9b1c3d5826a3a9bbe111f26b8
• https://github.com/libarchive/libarchive/blob/master/libarchive/archive_write_add_filter_gzip.c
• https://github.com/libarchive/libarchive/pull/2734
• https://github.com/libarchive/libarchive/pull/2734/commits
• https://github.com/libarchive/libarchive/pull/2734/files