AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
← CVE index
Δ / VULNERABILITY RECORD

CVE-2025-58183.

Source-reported disclosure and enrichment record.

SEVERITY / CVSSMEDIUM / 4.3CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EXPLOITATION STATUSNot listed in the cached KEV catalogThis does not establish absence of exploitation.
RECORD STATUSDeferredModified Oct 08, 2026

Disclosure summary

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

NIST National Vulnerability Database · NVD-CVE-2025-58183

Open original source · Updated Oct 08, 2026

Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.

Microsoft Security Updates (CVRF) · 2025-Oct

Open original source · Updated Sep 16, 2026

Unbounded allocation when parsing GNU sparse map in archive/tar

Maximum of vendor-reported product scores; products and fixed builds are associations, not a universal affected-version statement.

Microsoft maximum product score: 6.6

VendorProduct / associationVersion / bounds
Microsoft update guidecbl2 cri-o 1.22.3-16 on CBL Mariner 2.0 (MSRC status code 3)
Microsoft update guideazl3 containerized-data-importer 1.57.0-16 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guidecbl2 msft-golang 1.24.8-1 on CBL Mariner 2.0 (MSRC status code 3)
Microsoft update guidecbl2 skopeo 1.14.2-12 on CBL Mariner 2.0 (MSRC status code 3)
Microsoft update guideazl3 containerized-data-importer 1.57.0-17 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 gh 2.62.0-10 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 golang 1.25.5-1 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 moby-engine 25.0.3-14 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 skopeo 1.14.4-7 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 golang 1.25.6-1 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 golang 1.26.0-1 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 golang 1.25.7-1 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 golang 1.25.8-1 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 golang 1.25.10-1 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guidecbl2 containerized-data-importer 1.55.0-25 on CBL Mariner 2.0 (MSRC status code 3)
Microsoft update guidecbl2 golang 1.18.8-10 on CBL Mariner 2.0 (MSRC status code 3)
Microsoft update guidecbl2 golang 1.22.7-5 on CBL Mariner 2.0 (MSRC status code 3)
Microsoft update guidecbl2 moby-engine 24.0.9-18 on CBL Mariner 2.0 (MSRC status code 3)
Microsoft update guideazl3 gh 2.62.0-9 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 golang 1.23.12-1 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 golang 1.25.3-1 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 moby-engine 25.0.3-13 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 skopeo 1.14.4-6 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guidecbl2 containerized-data-importer 1.55.0-26 on CBL Mariner 2.0 (MSRC status code 3)
Microsoft update guidecbl2 cri-o 1.22.3-17 on CBL Mariner 2.0 (MSRC status code 3)
Microsoft update guidecbl2 moby-engine 24.0.9-19 on CBL Mariner 2.0 (MSRC status code 3)
Microsoft update guidecbl2 skopeo 1.14.2-13 on CBL Mariner 2.0 (MSRC status code 3)
Microsoft update guideazl3 golang 1.25.9-1 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 golang 1.25.11-3 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 golang 1.25.12-1 on Azure Linux 3.0 (MSRC status code 3)
Microsoft update guideazl3 golang 1.27.0-1 on Azure Linux 3.0 (MSRC status code 3)

Vendor remediation references

  • CBL-Mariner Releases · build 1.22.3-17 · product IDs 20522-17086, 20700-17086
  • Vendor guidance · product IDs 20522-17086, 20700-17086
  • CBL-Mariner Releases · build 1.57.0-17 · product IDs 20581-17084, 20709-17084
  • Vendor guidance · product IDs 20581-17084, 20709-17084
  • CBL-Mariner Releases · build 1.14.2-13 · product IDs 20539-17086, 20702-17086
  • Vendor guidance · product IDs 20539-17086, 20702-17086
  • CBL-Mariner Releases · build 2.62.0-10 · product IDs 20738-17084, 19613-17084
  • Vendor guidance · product IDs 20738-17084, 19613-17084
  • CBL-Mariner Releases · build 25.0.3-14 · product IDs 20740-17084, 19729-17084
  • Vendor guidance · product IDs 20740-17084, 19729-17084
  • CBL-Mariner Releases · build 1.14.4-7 · product IDs 20742-17084, 20583-17084
  • Vendor guidance · product IDs 20742-17084, 20583-17084
  • CBL-Mariner Releases · build 1.55.0-26 · product IDs 20536-17086, 20699-17086
  • Vendor guidance · product IDs 20536-17086, 20699-17086
  • CBL-Mariner Releases · build 24.0.9-19 · product IDs 20595-17086, 20701-17086
  • Vendor guidance · product IDs 20595-17086, 20701-17086
  • Vendor guidance · product IDs 21778-17084
  • Vendor guidance · product IDs 21778-17084

Original records & references

PUBLISHED 2025-10-29T19:16:19-04:00
MODIFIED 2026-10-08T06:10:00-04:00
INGESTED 2026-10-08T12:35:14-04:00