Is CVE-2025-64031 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64031 being exploited in the wild.

How severe is CVE-2025-64031?

Low severity, with a CVSS score of 2.5, published 14 September 2026.

Is there a fix for CVE-2025-64031?

A patch was published on 2025-09-14: Upstream fix merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64031 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-64031?

Check whether you run Libarchive at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64031: libarchive gzip writer heap buffer overflow in original-filename

CVE-2025-64031 · Severity: low · CVSS 2.5 · Published 2026-09-14

libarchive is a widely-used library for reading and writing archive formats (tar, zip, etc.) across Unix-like systems, macOS, and Windows. A heap-based buffer overflow in the gzip compression module allows an attacker who can influence the original-filename option to crash processes using the library or potentially corrupt heap memory. This could impact any application that exposes the gzip original-filename option to untrusted input, such as archiving utilities.

Technologies: Libarchive. Vendors: Libarchive.

Quick answers

Is CVE-2025-64031 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64031 being exploited in the wild.
How severe is CVE-2025-64031?: Low severity, with a CVSS score of 2.5, published 14 September 2026.
Which products and versions are affected?: Libarchive 3.8.0, 3.8.1.
Is there a fix for CVE-2025-64031?: A patch was published on 2025-09-14: Upstream fix merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64031 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-64031?: Check whether you run Libarchive at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in libarchive 3.8.0 and 3.8.1 in archive_compressor_gzip_open() within archive_write_add_filter_gzip.c. The vulnerable code uses strcpy() to copy a caller-supplied original-filename string into the compression output buffer without validating the length against remaining buffer capacity. An attacker who can control the original-filename parameter (via application interface or configuration) can provide an excessively long string to overflow the heap, corrupt heap metadata, and trigger process termination. The vulnerability requires direct control of the original-filename option; ordinary archive contents do not directly influence it. No arbitrary code execution has been demonstrated. The fix in libarchive 3.8.2 limits the filename to 32 KiB or remaining buffer space and warns on truncation.

Affected products

libarchive libarchive 3.8.0, 3.8.1

Timeline

2025-09-11: disclosed: Privately reported via GitHub Security Advisory
2025-09-14: patched: Upstream fix merged
2025-10-15: other: libarchive 3.8.2 released with fix
2026-03-12: advisory: Public advisory published
2026-09-14: other: CVE-2025-64031 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.