An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
References
| Link | Resource |
|---|---|
| https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753 | Exploit Third Party Advisory |
| https://github.com/libarchive/libarchive/issues/2725 | Exploit Issue Tracking Patch |
Configurations
History
04 Feb 2026, 21:19
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Libarchive libarchive
Libarchive |
|
| CPE | cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:* | |
| References | () https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753 - Exploit, Third Party Advisory | |
| References | () https://github.com/libarchive/libarchive/issues/2725 - Exploit, Issue Tracking, Patch |
05 Nov 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-05 16:15
Updated : 2026-02-04 21:19
NVD link : CVE-2025-60753
Mitre link : CVE-2025-60753
CVE.ORG link : CVE-2025-60753
JSON object : View
Products Affected
libarchive
- libarchive