Hi,
I spend some time today checking it and it seems that this CVE was fixed in 3.8.9 by cherry-pick:
https://github.com/libarchive/libarchive/commit/22ffe8e8e459970f3bc86b0267493fc4aa8249b8
What should I do on a master then?

Best regards,
Jakub Szczudlo