Executive brief
libarchive is a widely-used library for reading and writing archive formats (tar, zip, etc.) across Unix-like systems, macOS, and Windows. A heap-based buffer overflow in the gzip compression module allows an attacker who can influence the original-filename option to crash processes using the library or potentially corrupt heap memory. This could impact any application that exposes the gzip original-filename option to untrusted input, such as archiving utilities.
Technical details
A heap-based buffer overflow (CWE-122) exists in libarchive 3.8.0 and 3.8.1 in archive_compressor_gzip_open() within archive_write_add_filter_gzip.c. The vulnerable code uses strcpy() to copy a caller-supplied original-filename string into the compression output buffer without validating the length against remaining buffer capacity. An attacker who can control the original-filename parameter (via application interface or configuration) can provide an excessively long string to overflow the heap, corrupt heap metadata, and trigger process termination. The vulnerability requires direct control of the original-filename option; ordinary archive contents do not directly influence it. No arbitrary code execution has been demonstrated. The fix in libarchive 3.8.2 limits the filename to 32 KiB or remaining buffer space and warns on truncation.
Affected products
- libarchive libarchive 3.8.0, 3.8.1
Timeline
- 2025-09-11: disclosed: Privately reported via GitHub Security Advisory
- 2025-09-14: patched: Upstream fix merged
- 2025-10-15: other: libarchive 3.8.2 released with fix
- 2026-03-12: advisory: Public advisory published
- 2026-09-14: other: CVE-2025-64031 published