JLSEC-2025-250 Medium 4.0

libarchive through 3.7.7 has a heap-based buffer over-read in `header_gnu_longlink` in...

JLSEC Published: Nov 25, 2025
Modified: Jul 23, 2026
Severity: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Packages: LibArchive_jll < 3.7.9+0
Upstream: CVE-2024-57970 GHSA-2q66-6w43-8rm9 EUVD-2024-53870

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.

References

https://github.com/advisories/GHSA-2q66-6w43-8rm9
https://github.com/libarchive/libarchive/issues/2415
https://github.com/libarchive/libarchive/pull/2422
https://nvd.nist.gov/vuln/detail/CVE-2024-57970