CVE-2024-48615 Null dereference in n/a

High 7.5 Published 28 Mar 2025 Updated 1 Apr 2025

A null pointer dereference in libarchive's bsdtar utility allows attackers to cause a denial of service via crafted PAX extension headers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-48615?

CVE-2024-48615 is a high-severity vulnerability in Libarchive Libarchive, published on 28 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.

Weakness: CWE-476

Which versions are affected by CVE-2024-48615?

It affects 1 product.

Products include Libarchive Libarchive.

How do I fix CVE-2024-48615?

Upgrade to a fixed version.

Is CVE-2024-48615 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-48615 exists.

All Libarchive Libarchive vulnerabilities

Sources

Also known as AZL-59338, AZL-59377, AZL-59385, BELL-CVE-2024-48615, GHSA-57fm-4q7w-88cr, JLSEC-2025-244.