CVE-2025-15570

Summary

A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results in use after free. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected Software

Weaknesses

• CWE-416: Use After Free
• CWE-119: Memory Corruption

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

CVE Program Container

Additional References

• https://lists.debian.org/debian-lts-announce/2026/05/msg00011.html

References

• https://vuldb.com/?id.344926
• https://vuldb.com/?ctiid.344926
• https://vuldb.com/?submit.752595
• https://github.com/ckolivas/lrzip/issues/262
• https://github.com/user-attachments/files/21709004/PoC_UAF.zip
• https://github.com/ckolivas/lrzip/

• ←Previous
• Next→