What is CVE-2025-64031?

CVE-2025-64031 is a low-severity vulnerability in Libarchive, classified under Heap-based Buffer Overflow. CVSS score: 2.5/10. Published 2026-09-14.

How severe is CVE-2025-64031?

Low severity. CVSS v3 base score is 2.5 out of 10.

Buffer overflow in Libarchive

CVE-2025-64031

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)

Vulnerability class: Buffer Overflow

EPSS: 0.001 (2.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.5 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L.

Affected products

Libarchive

Weakness classification (CWE)

CWE-122 — Heap-based Buffer Overflow

References

Frequently asked questions

What is CVE-2025-64031?: CVE-2025-64031 is a low-severity vulnerability in Libarchive, classified under Heap-based Buffer Overflow. CVSS score: 2.5/10. Published 2026-09-14.
How severe is CVE-2025-64031?: Low severity. CVSS v3 base score is 2.5 out of 10.