CVE-2025-15614
ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
- Record
CVE-2025-15614- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2025-210857
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
- Record
EUVD-2025-210857- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-85v4-hj64-h8x4
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when...
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
- Record
GHSA-85v4-hj64-h8x4- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
- Record
CVE-2025-15614- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
- Record
CVE-2025-15614- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-15614
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
- Record
DEBIAN-CVE-2025-15614- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-15614
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
- Record
UBUNTU-CVE-2025-15614- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVMGASA-2026-0495 No score
Updated ugrep package fixes a security vulnerability
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
- Record
MGASA-2026-0495- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ugrepDebian:12 |
All versions, plus listed versions 3.11.2+dfsg-13.12.1+dfsg-13.12.6+dfsg-13.12.7+dfsg-14.1.0+dfsg-1 Show 33 moreShow less4.3.1+dfsg-14.3.2+dfsg-14.3.2+dfsg-24.3.2+dfsg-34.3.3+dfsg-14.3.4+dfsg-14.3.6+dfsg-14.4.1+dfsg-14.5.1+dfsg-14.5.1+dfsg-24.5.1+dfsg-34.5.1+dfsg-44.5.1+dfsg-54.5.2+dfsg-15.0.0+dfsg-15.1.1+dfsg-15.1.3+dfsg-15.1.4+dfsg-16.0.0+dfsg-16.0.1+dfsg-16.4.1+dfsg-16.5.0+dfsg-17.0.2+dfsg-17.0.4+dfsg-17.1.1+dfsg-17.1.2+dfsg-17.2.1+dfsg-17.4.2+dfsg-17.5.0+dfsg-17.6.0+dfsg-17.8.2+dfsg-17.8.2+dfsg-27.8.4+dfsg-1 |
None known |
ugrepDebian:13 |
All versions, plus listed versions 7.4.2+dfsg-17.5.0+dfsg-17.6.0+dfsg-17.8.2+dfsg-17.8.2+dfsg-27.8.4+dfsg-1 |
None known |
ugrepDebian:14 |
before 7.6.0+dfsg-1, plus listed versions 7.4.2+dfsg-17.5.0+dfsg-1 |
7.6.0+dfsg-1 |
ugrepMageia:10 |
before 7.8.5-1.mga10 | 7.8.5-1.mga10 |
ugrepUbuntu:22.04:LTS |
All versions, plus listed versions 3.3.6+dfsg-13.3.8+dfsg-13.3.9+dfsg-13.3.10+dfsg-13.5.0+dfsg-13.6.0+dfsg-13.7.1+dfsg-13.7.2+dfsg-1 |
None known |
ugrepUbuntu:24.04:LTS |
All versions, plus listed versions 3.12.7+dfsg-14.3.1+dfsg-14.3.2+dfsg-24.3.2+dfsg-34.3.3+dfsg-1 Show 5 moreShow less4.3.4+dfsg-14.3.6+dfsg-14.4.1+dfsg-14.5.2+dfsg-15.0.0+dfsg-1 |
None known |
ugrepUbuntu:26.04:LTS |
All versions, plus listed versions 7.4.2+dfsg-17.5.0+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-15614 is a medium vulnerability (CVSS 4.8) in Genivia Ugrep, published September 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in ugrep 7.6.0+dfsg-1.
References
github.com/Genivia/ugrep/issues/511
vulncheck.com/advisories/ugrep-before-7.6.0-heap-buffer-over-read-via-z-decompression
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2025-15614
security-tracker.debian.org/tracker/CVE-2025-15614
advisories.mageia.org/MGASA-2026-0495.html
bugs.mageia.org/show_bug.cgi?id=36487
ubuntu.com/security/CVE-2025-15614
cve.org/CVERecord?id=CVE-2025-15614