CVE-2025-60753: An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).

Overview

Severity

Medium (CVSS 5.5)

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P

Exploit Status

Not Exploited

Patch Tuesday

2025-Nov

Released

2025-11-11

Last Updated

2026-02-18

EPSS Score

0.02% (percentile: 5.5%)

Affected Products (4)

Open Source Software

• azl3 libarchive 3.7.7-3 on Azure Linux 3.0
• cbl2 libarchive 3.6.1-7 on CBL Mariner 2.0

Other

• 20888-17084
• 20889-17086

Revision History

• 2025-11-11: Information published.
• 2026-02-18: Information published.