CVE-2025-15614

EUVD-2025-210857
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.3 LOW
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.51%
Debian logo
Debian Releases
Debian Product
Codename
ugrep
bookworm
unimportant
forky
7.8.4+dfsg-1
fixed
sid
7.8.4+dfsg-1
fixed
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ugrep
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/Genivia/ugrep
https://github.com/Genivia/ugrep/blob/v7.5.0/src/zopen.c#L673
https://github.com/Genivia/ugrep/commit/c12849a11264e2c81c860bf78ee9039772f307a4
https://github.com/Genivia/ugrep/issues/511
https://github.com/Genivia/ugrep/releases/tag/v7.6.0
https://www.vulncheck.com/advisories/ugrep-before-7.6.0-heap-buffer-over-read-via-z-decompression