CVE-2025-25724
Libarchive ≤ 3.7.7
Raw vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:LSummary
CVE-2025-25724 is a medium-severity Unchecked Return Value (CWE-252) vulnerability in Libarchive Libarchive. Its CVSS base score is 4.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-25724 is a vulnerability in the list_item_verbose function within tar/util.c of libarchive through version 3.7.7. The issue stems from a failure to check the return value of strftime, which can result in a denial of service or unspecified other impact when processing a crafted TAR archive using verbose output level 2. For example, a custom locale may exceed the 100-byte buffer allocated for the operation.
Exploitation requires local access (AV:L) with high attack complexity (AC:H), no privileges (PR:N), and no user interaction (UI:N), as indicated by the CVSS v3.1 base score of 4.0 (C:N/I:L/A:L/S:U). A local attacker can thus trigger low-impact integrity and availability effects, such as denial of service, through a malicious TAR file.
Proof-of-concept code demonstrating the issue is available at https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92 and https://github.com/Ekkosun/pocs/blob/main/bsdtarbug. The vulnerable source code lines are visible in the libarchive repository at https://github.com/libarchive/libarchive/blob/b439d586f53911c84be5e380445a8a259e19114c/tar/util.c#L751-L752.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5869
Vulnerability Data
list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2.…
more
For example, the 100-byte buffer may not be sufficient for a custom locale.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and code evaluation can discover instances where return values are ignored.
Requiring a documented development process and coding standards can mandate explicit checking of all function return values.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require checking and handling all function return values to detect error conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect missing return-value checks.
Secure development life cycle mandates verification of return values to prevent undetected failures.
Application security requirements include input/output validation and error handling that covers return-value checks.
Secure system architecture and engineering principles require robust error handling and defensive coding practices.
Secure coding explicitly requires checking return values to avoid CWE-252.