AI Threat AlertCVE-2025-5918: libarchive: bsdtar stream out-of-bounds read hits RHOAI
LOWCVE-2025-5918 is an out-of-bounds read in libarchive's bsdtar that can be triggered when a file stream is piped into it, causing a crash, unpredictable behavior or limited memory disclosure. It is rated low (CVSS 3.9) because it needs local access, low privileges and a user action. There is no CISA KEV listing, no public exploit and no Nuclei template, and no EPSS score is available, so there is no sign of exploitation. The reason it shows up in AI inventories is the blast radius: libarchive is bundled in dozens of Red Hat OpenShift AI (RHOAI) container images and in RHCOS node images, and the package has 695 downstream dependents and a mediocre OpenSSF Scorecard of 5.4/10. Treat this as routine patch hygiene rather than an emergency. Pick up the libarchive 3.8.0 fix (upstream PR 2584) through Red Hat's updated RHOAI and OpenShift images on your normal patch cycle. Prioritize any pipeline that pipes untrusted archives into bsdtar.
What is the risk?
Low overall risk. The attack vector is local, privileges are low and user interaction is required. Confidentiality and availability impacts are both rated low, and integrity is unaffected. No KEV listing, public exploit or scanner template exists, and EPSS is not available. The risk rises slightly in multi-tenant ML platforms (shared notebooks, pipelines) where untrusted users or automated jobs can feed crafted archive streams to bsdtar inside containers that hold sensitive tokens or model artifacts.
How does the attack unfold?
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
4 stepsUpdate to libarchive 3.8.0 or later, or apply the Red Hat errata for the affected RHOAI and OpenShift images (see access.redhat.com/security/cve/CVE-2025-5918).
Rebuild custom images based on RHEL 9 and OpenShift base images to pick up the fixed package.
Avoid piping untrusted or unvalidated archive streams into bsdtar; extract in sandboxed, least-privilege containers.
Detection: monitor for bsdtar crashes or segfaults in pipeline, notebook and model-serving containers, and track image scan results for the libarchive package across the cluster.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2025-5918?
CVE-2025-5918 is an out-of-bounds read in libarchive's bsdtar that can be triggered when a file stream is piped into it, causing a crash, unpredictable behavior or limited memory disclosure. It is rated low (CVSS 3.9) because it needs local access, low privileges and a user action. There is no CISA KEV listing, no public exploit and no Nuclei template, and no EPSS score is available, so there is no sign of exploitation. The reason it shows up in AI inventories is the blast radius: libarchive is bundled in dozens of Red Hat OpenShift AI (RHOAI) container images and in RHCOS node images, and the package has 695 downstream dependents and a mediocre OpenSSF Scorecard of 5.4/10. Treat this as routine patch hygiene rather than an emergency. Pick up the libarchive 3.8.0 fix (upstream PR 2584) through Red Hat's updated RHOAI and OpenShift images on your normal patch cycle. Prioritize any pipeline that pipes untrusted archives into bsdtar.
Is CVE-2025-5918 actively exploited?
No confirmed active exploitation of CVE-2025-5918 has been reported, but organizations should still patch proactively.
How to fix CVE-2025-5918?
1. Update to libarchive 3.8.0 or later, or apply the Red Hat errata for the affected RHOAI and OpenShift images (see access.redhat.com/security/cve/CVE-2025-5918). 2. Rebuild custom images based on RHEL 9 and OpenShift base images to pick up the fixed package. 3. Avoid piping untrusted or unvalidated archive streams into bsdtar; extract in sandboxed, least-privilege containers. 4. Detection: monitor for bsdtar crashes or segfaults in pipeline, notebook and model-serving containers, and track image scan results for the libarchive package across the cluster.
What systems are affected by CVE-2025-5918?
This vulnerability affects the following AI/ML architecture patterns: Model serving, Training pipelines, ML pipeline orchestration, Notebook and workbench environments, Model registries, Kubernetes-based ML platforms.
What is the CVSS score for CVE-2025-5918?
CVE-2025-5918 has a CVSS v3.1 base score of 3.9 (LOW).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.001AI SoftwareAML.T0029Denial of AI ServiceCompliance Controls Affected
What are the technical details?
Original Advisory
A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.
Exploitation Scenario
A low-privileged user on a shared data science platform uploads a crafted archive stream (a dataset or model bundle) and persuades a colleague or automated pipeline step to pipe it into bsdtar. The tool reads past the end of the buffer, crashing the pipeline step or leaking a small amount of adjacent memory. The attacker gains at most a disruption of the ML workflow or minor information exposure, with no direct path to code execution.
Weaknesses (CWE)
CWE-125 — Out-of-bounds Read: The product reads data past the end, or before the beginning, of the intended buffer.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] Use a language that provides appropriate memory abstractions.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:LReferences
- access.redhat.com/security/cve/CVE-2025-5918vdb-entryx_refsource_REDHAT
- bugzilla.redhat.com/show_bug.cgiissue-trackingx_refsource_REDHAT
- github.com/libarchive/libarchive/pull/2584
- github.com/libarchive/libarchive/releases/tag/v3.8.0
Timeline
Related Vulnerabilities
CVE-2025-1537910.0MLflow: RCE via unsanitized model dependency specs
Same package: mlflowCVE-2023-376510.0MLflow: path traversal allows arbitrary file read
Same package: mlflowCVE-2023-27809.8MLflow: path traversal allows arbitrary file read/write
Same package: mlflowCVE-2026-26359.8mlflow: security flaw enables exploitation
Same package: mlflowCVE-2023-11779.8MLflow: path traversal allows arbitrary file read/write
Same package: mlflow