EUVD-2025-210902
GHSA-pqgv-phc2-5p8r
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Local access and high complexity reflect the non-default API usage required; impact is crash-only (A:L) with no confidentiality or integrity consequence.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)
AnalysisAI
Unchecked strcpy() of the GZIP original-filename header field in libarchive 3.8.x causes a heap-based buffer overflow (CWE-122) in the gzip compression writer, with impact limited to a low-severity application crash. The overflow can only be triggered when a caller explicitly passes an overly long, untrusted original-filename string through the libarchive API - a condition the CVE itself characterizes as marginally plausible, since this field is not derived from archived input data. No active exploitation has been confirmed, and the official CVSS score of 2.5 (Low) with AV:L/AC:H/UI:R accurately reflects the constrained, non-default exploitation path.
Technical ContextAI
libarchive is a widely-used C library for reading and writing archive formats (tar, zip, cpio, etc.) and is the backend for the bsdtar utility. The affected code lives in archive_write_add_filter_gzip.c, specifically in archive_compressor_gzip_open(). The GZIP format (RFC 1952) supports an optional FNAME header field storing the original filename of the compressed content. Prior to 3.8.2, the code unconditionally performed strcpy((char*)data->compressed + 10, data->original_filename) into a fixed-size heap-allocated buffer without first validating the length of the source string. The PR #2734 diff confirms the root cause: the fix replaces the raw strcpy with a bounded copy that limits the filename to min(32768, available_buffer_space) bytes and gracefully emits ARCHIVE_WARN if the filename is too long, rather than copying it. Affected CPE: cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:* (3.8.x series before 3.8.2).
RemediationAI
Upgrade to libarchive 3.8.2, which replaces the unbounded strcpy() with a length-checked bounded copy, limits the GZIP original-filename field to the lesser of 32,768 bytes or the remaining space in the compressed header buffer, and discards oversized filenames with an ARCHIVE_WARN return rather than a buffer overflow. The fix is available upstream via PR #2734 at https://github.com/libarchive/libarchive/pull/2734. Applications that never set a gzip original-filename via the libarchive API are not exposed to this code path and require no immediate action. As a compensating control before patching, audit all call sites that invoke archive_write_add_filter_gzip() to ensure any original-filename value is either truncated to a safe length or sourced exclusively from trusted, length-bounded inputs - this eliminates the attack surface without patching but requires application-level code review.
More in Libarchive
View allCVE-2025-5914 is an integer overflow vulnerability in libarchive's archive_read_format_rar_seek_data() function that lea
Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enable
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mig
Stack-based buffer overflow in the parse_device function in archive_read_support_format_mtree.c in libarchive before 3.2
Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 a
Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 al
Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtr
Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pa
Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arb
Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (appl
Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive befo
Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init. Rated medium s
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today