CVE-2025-15571

ckolivas lrzip stream.c ucompthread null pointer dereference

4.8 MediumFix available

A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.19%Up 0.2 points since Feb 11, 2026

What each source reports

CVE List Score used 4.8

ckolivas lrzip stream.c ucompthread null pointer dereference

Record: CVE-2025-15571
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
CVSS 3.0: 3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
CVSS 2.0: 1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR
Weakness: CWE-476, CWE-404
Updated: 2026-11-02

EUVDEUVD-2025-207261 4.8

Record: EUVD-2025-207261
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-x954-5gxx-h6v4 1.9

A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability...

Record: GHSA-x954-5gxx-h6v4
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-404, CWE-476
Updated: 2026-11-02

NVD 1.9

Record: CVE-2025-15571
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 1.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P
Weakness: CWE-404, CWE-476
Updated: 2026-11-02

OSV 1.9

ckolivas lrzip stream.c ucompthread null pointer dereference

Record: CVE-2025-15571
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness: CWE-404, CWE-476
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-15571 5.5

Record: DEBIAN-CVE-2025-15571
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-15571 1.9

Record: UBUNTU-CVE-2025-15571
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21179-1 No score

Security update for lrzip

This update for lrzip fixes the following issues:

Changes in lrzip:

Update to version 0.660:
- Do not clean up thread structures in decompression failure conditions, fixing a use-after-free in lzma_decompress_buf() and a NULL pointer dereference in ucompthread() on corrupt/malicious archives (CVE-2025-15570, boo#1258016; CVE-2025-15571, boo#1258023)
- Handle -L given without a parameter, fixing a NULL pointer dereference (CVE-2025-9396, boo#1248598)
- Add write bounds checking in libzpaq and sanity checks for maliciously encoded headers and oversized allocations
- Various STDIO, portability and build fixes (OpenBSD support, non-x86 zpaq, autoconf warnings); drop Doxygen doc build

Record: openSUSE-SU-2026:21179-1
Updated: 2026-11-02

Affected products

ckolivas lrzip

Affected packages

Affected packages
Package	Affected	Fixed
`lrzip` Debian:12	All versions, plus listed versions 0.651-20.651-30.660-1	None known
`lrzip` Debian:13	All versions, plus listed versions 0.651-30.660-1	None known
`lrzip` Debian:14	before 0.660-1, plus listed versions 0.651-3	0.660-1
`lrzip` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 0.608-20.616-10.616-1ubuntu0.1~esm0.616-1ubuntu0.1~esm10.616-1ubuntu0.1~esm2	None known
`lrzip` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 0.621-10.621-1ubuntu0.1~esm10.621-1ubuntu0.1~esm2	None known
`lrzip` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 0.631-10.631-1ubuntu0.1~esm10.631-1+deb9u1build0.18.04.10.631-1+deb9u3build0.18.04.1	None known
`lrzip` Ubuntu:20.04:LTS	All versions, plus listed versions 0.631+git180528-10.631+git180528-1build10.631+git180528-1+deb10u1build0.20.04.1	None known
`lrzip` Ubuntu:22.04:LTS	All versions, plus listed versions 0.641-10.651-20.651-2ubuntu0.22.04.1	None known
`lrzip` Ubuntu:24.04:LTS	All versions, plus listed versions 0.651-2ubuntu1	None known
`lrzip` Ubuntu:25.10	All versions, plus listed versions 0.651-2ubuntu10.651-3	None known
`lrzip` Ubuntu:26.10	All versions, plus listed versions 0.660-1	None known
`lrzip` Ubuntu:26.04:LTS	All versions, plus listed versions 0.651-30.651-3build10.660-1	None known
`lrzip` openSUSE:Leap 16.0 From an advisory covering 3 CVEs	before 0.660-bp160.1.1	0.660-bp160.1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-15571 is a medium vulnerability (CVSS 4.8) in Ckolivas Lrzip, published February 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in lrzip 0.660-1.

References

Show 12 moreShow less