JLSEC-2025-243 list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value,...

🗓️ 25 Nov 2025 22:03:17Reported by GoogleType

osv

osv🔗 osv.dev

Libarchive 3.7.7: list_item_verbose ignores strftime result, risking denial of service from crafted tar with verbose two.

Reporter	Title	Published	Views	Family All 137
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues	28 Aug 202521:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	6 Aug 202516:37	–	ibm
IBM Security Bulletins	Security Bulletin: Watsonx BI is affected by the use of Insufficiently Random Values causing a vulnerability in form-data allowing HTTP Parameter Pollution (HPP)	17 Sep 202517:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	23 Jul 202517:22	–	ibm
Tenable Nessus	AlmaLinux 10 : libarchive (ALSA-2025:9420)	9 Oct 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : libarchive (ALSA-2025:9431)	30 Jun 202500:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: libarchive (CVE-2025-25724)	10 Apr 202500:00	–	nessus
Tenable Nessus	CentOS 9 : libarchive-3.5.3-5.el9	11 Jun 202500:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2025-1591)	11 Jun 202500:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2025-1592)	11 Jun 202500:00	–	nessus

Source	Link
gist	www.gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92
github	www.github.com/Ekkosun/pocs/blob/main/bsdtarbug
github	www.github.com/advisories/GHSA-722w-734r-qg74
github	www.github.com/libarchive/libarchive/blob/b439d586f53911c84be5e380445a8a259e19114c/tar/util.c
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-25724

20 Apr 2026 17:16Current

7High risk

Vulners AI Score7

CVSS 3.14

EPSS0.00028

libarchive strftime list item verbose denial of service crafted tar locale buffer