CVE-2025-60753

Name of the Vulnerable Software and Affected Versions libarchive versions prior to 3.8.1

Description The software is a BSD-licensed C programming library providing streaming access to various archive formats like tar, cpio, pax, zip, and ISO9660 images. It includes bsdtar and bsdcpio implementations. A flaw exists in the apply substitution function within tar/subst.c when handling specially crafted -s substitution rules. This can result in excessive memory allocation, potentially leading to a denial of service through an out-of-memory crash.

Recommendations Update to version 3.8.1 or later.