AI Threat AlertCVE-2025-5915: libarchive: heap over-read via LZSS RAR filter in RHOAI
MEDIUMCVE-2025-5915 is a heap buffer over-read in libarchive's RAR decompression. A filter block larger than the LZSS window makes the library read past its buffer, which can crash the process or leak adjacent memory. It is rated medium (CVSS 6.6) and needs local access, low privileges and a user to open a crafted archive. It is not in CISA KEV, no public exploit or Nuclei template is known, and no EPSS score is available, so near-term exploitation looks unlikely. The reach is wide, though: libarchive has 695 downstream dependents, and Red Hat lists about 35 OpenShift AI and CoreOS container images as affected, including MLflow, KServe, KubeRay and the notebook and pipeline controllers. Patch to libarchive 3.8.0 or later through Red Hat's updated images in your normal cycle. Prioritize any workflow that unpacks untrusted RAR files, such as model, dataset or notebook uploads.
What is the risk?
Medium overall. Exploitation is local with low complexity, but it needs low privileges and user interaction, so remote mass exploitation is unlikely. Impact is high for confidentiality and availability (C:H/A:H), with no integrity impact. There is no KEV listing, no public exploit and no scanner template. Exposure is mostly through container base images that bundle libarchive, so many platforms inherit the flaw without anyone choosing to install it. The package scores 5.4/10 on OpenSSF Scorecard and has 137 other CVEs, which points to a recurring memory-safety maintenance burden.
How does the attack unfold?
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
1 step1) Apply Red Hat's updated RHOAI and OpenShift images that ship libarchive 3.8.0 or later, and rebuild any custom images based on affected bases. 2) Scan container images and SBOMs for libarchive versions below 3.8.0 across ML platform namespaces. 3) Do not extract untrusted RAR archives in model, dataset or notebook ingestion paths, and restrict the archive formats you accept. 4) Run archive-handling workloads with least privilege, resource limits and network egress controls so a crash or leak stays contained. 5) Monitor for repeated segfaults or OOM restarts in pods that process archives. 6) Track Red Hat advisory CVE-2025-5915 and Bugzilla 2370865 for per-image fix status.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2025-5915?
CVE-2025-5915 is a heap buffer over-read in libarchive's RAR decompression. A filter block larger than the LZSS window makes the library read past its buffer, which can crash the process or leak adjacent memory. It is rated medium (CVSS 6.6) and needs local access, low privileges and a user to open a crafted archive. It is not in CISA KEV, no public exploit or Nuclei template is known, and no EPSS score is available, so near-term exploitation looks unlikely. The reach is wide, though: libarchive has 695 downstream dependents, and Red Hat lists about 35 OpenShift AI and CoreOS container images as affected, including MLflow, KServe, KubeRay and the notebook and pipeline controllers. Patch to libarchive 3.8.0 or later through Red Hat's updated images in your normal cycle. Prioritize any workflow that unpacks untrusted RAR files, such as model, dataset or notebook uploads.
Is CVE-2025-5915 actively exploited?
No confirmed active exploitation of CVE-2025-5915 has been reported, but organizations should still patch proactively.
How to fix CVE-2025-5915?
1) Apply Red Hat's updated RHOAI and OpenShift images that ship libarchive 3.8.0 or later, and rebuild any custom images based on affected bases. 2) Scan container images and SBOMs for libarchive versions below 3.8.0 across ML platform namespaces. 3) Do not extract untrusted RAR archives in model, dataset or notebook ingestion paths, and restrict the archive formats you accept. 4) Run archive-handling workloads with least privilege, resource limits and network egress controls so a crash or leak stays contained. 5) Monitor for repeated segfaults or OOM restarts in pods that process archives. 6) Track Red Hat advisory CVE-2025-5915 and Bugzilla 2370865 for per-image fix status.
What systems are affected by CVE-2025-5915?
This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps platforms, notebook environments, Kubernetes-based AI platforms.
What is the CVSS score for CVE-2025-5915?
CVE-2025-5915 has a CVSS v3.1 base score of 6.6 (MEDIUM).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.001AI SoftwareAML.T0011User ExecutionAML.T0029Denial of AI ServiceCompliance Controls Affected
What are the technical details?
Original Advisory
A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.
Exploitation Scenario
An attacker with a low-privilege account on a shared data science platform uploads a crafted RAR file as a dataset or model bundle. A user or automated pipeline in an RHOAI notebook or workbench extracts it with libarchive, which triggers the over-read. The result is a crash that disrupts the pipeline, or a leak of heap memory that may contain credentials or data from the process. The attacker cannot reliably control what leaks, so this is a nuisance and information-disclosure risk, not a path to code execution.
Weaknesses (CWE)
CWE-122 — Heap-based Buffer Overflow: The product writes past the end of a buffer that was allocated on the heap.
- Pre-design: Use a language or compiler that performs automatic bounds checking.
- [Architecture and Design] Use an abstraction library to abstract away risky APIs. Not a complete solution.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:HReferences
- access.redhat.com/security/cve/CVE-2025-5915vdb-entryx_refsource_REDHAT
- bugzilla.redhat.com/show_bug.cgiissue-trackingx_refsource_REDHAT
- github.com/libarchive/libarchive/pull/2599
- github.com/libarchive/libarchive/releases/tag/v3.8.0
Timeline
Related Vulnerabilities
CVE-2025-1537910.0MLflow: RCE via unsanitized model dependency specs
Same package: mlflowCVE-2023-376510.0MLflow: path traversal allows arbitrary file read
Same package: mlflowCVE-2023-27809.8MLflow: path traversal allows arbitrary file read/write
Same package: mlflowCVE-2026-26359.8mlflow: security flaw enables exploitation
Same package: mlflowCVE-2023-11779.8MLflow: path traversal allows arbitrary file read/write
Same package: mlflow