CVE-2025-9396
ckolivas lrzip strtol_l.c __GI_____strtol_l_internal null pointer dereference
A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
ckolivas lrzip strtol_l.c __GI_____strtol_l_internal null pointer dereference
A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
- Record
CVE-2025-9396- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R - CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R - CVSS 2.0
- 1.7
AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR - Weakness
- CWE-476, CWE-404
- Updated
- 2026-11-02
EUVDEUVD-2025-25651
A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
- Record
EUVD-2025-25651- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7p5p-5c63-6f3w
A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function...
A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
- Record
GHSA-7p5p-5c63-6f3w- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-404, CWE-476
- Updated
- 2026-11-02
NVD
A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
- Record
CVE-2025-9396- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 1.7 Low
AV:L/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-404, CWE-476
- Updated
- 2026-11-02
OSV
ckolivas lrzip strtol_l.c __GI_____strtol_l_internal null pointer dereference
A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
- Record
CVE-2025-9396- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-404, CWE-476
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-9396
A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
- Record
DEBIAN-CVE-2025-9396- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2025-9396
A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
- Record
UBUNTU-CVE-2025-9396- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVMGASA-2026-0292 No score
Updated lrzip package fixes security vulnerabilities
The updated package fixes security vulnerabilities: ckolivas lrzip stream.c lzma_decompress_buf use after free. (CVE-2025-15570) ckolivas lrzip strtol_l.c __GI_____strtol_l_internal null pointer dereference. (CVE-2025-9396)
- Record
MGASA-2026-0292- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11093-1 No score
lrzip-0.660-1.1 on GA media
These are all security issues fixed in the lrzip-0.660-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11093-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21179-1 No score
Security update for lrzip
This update for lrzip fixes the following issues:
Changes in lrzip:
- Update to version 0.660:
- Do not clean up thread structures in decompression failure conditions, fixing a use-after-free in lzma_decompress_buf() and a NULL pointer dereference in ucompthread() on corrupt/malicious archives (CVE-2025-15570, boo#1258016; CVE-2025-15571, boo#1258023)
- Handle -L given without a parameter, fixing a NULL pointer dereference (CVE-2025-9396, boo#1248598)
- Add write bounds checking in libzpaq and sanity checks for maliciously encoded headers and oversized allocations
- Various STDIO, portability and build fixes (OpenBSD support, non-x86 zpaq, autoconf warnings); drop Doxygen doc build
- Record
openSUSE-SU-2026:21179-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lrzipDebian:12 |
All versions, plus listed versions 0.651-20.651-30.660-1 |
None known |
lrzipDebian:13 |
All versions, plus listed versions 0.651-30.660-1 |
None known |
lrzipDebian:14 |
All versions, plus listed versions 0.651-30.660-1 |
None known |
lrzipMageia:10 From an advisory covering 2 CVEs |
before 0.660-1.mga10 | 0.660-1.mga10 |
lrzipUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.608-20.616-10.616-1ubuntu0.1~esm0.616-1ubuntu0.1~esm10.616-1ubuntu0.1~esm2 |
None known |
lrzipUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.621-10.621-1ubuntu0.1~esm10.621-1ubuntu0.1~esm2 |
None known |
lrzipUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.631-10.631-1ubuntu0.1~esm10.631-1+deb9u1build0.18.04.10.631-1+deb9u3build0.18.04.1 |
None known |
lrzipUbuntu:20.04:LTS |
All versions, plus listed versions 0.631+git180528-10.631+git180528-1build10.631+git180528-1+deb10u1build0.20.04.1 |
None known |
lrzipUbuntu:22.04:LTS |
All versions, plus listed versions 0.641-10.651-20.651-2ubuntu0.22.04.1 |
None known |
lrzipUbuntu:24.04:LTS |
All versions, plus listed versions 0.651-2ubuntu1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lrzipUbuntu:25.10 |
All versions, plus listed versions 0.651-2ubuntu10.651-3 |
None known |
lrzipUbuntu:26.10 |
All versions, plus listed versions 0.660-1 |
None known |
lrzipUbuntu:26.04:LTS |
All versions, plus listed versions 0.651-30.651-3build10.660-1 |
None known |
lrzipopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.660-1.1 | 0.660-1.1 |
lrzipopenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 0.660-bp160.1.1 | 0.660-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-9396 is a medium vulnerability (CVSS 4.8) in Ckolivas Lrzip, published August 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 21st percentile. No source names a fixed version.
References
vuldb.com?id.321232
github.com/ckolivas/lrzip/issues/264
drive.google.com/file/d/1EFbiiM1d7Ozb0ucZt6zRO3ngU8ugUnCn/view?usp=sharing
nvd.nist.gov/vuln/detail/CVE-2025-9396
Show 15 moreShow less
security-tracker.debian.org/tracker/CVE-2025-9396
advisories.mageia.org/MGASA-2026-0292.html
bugs.mageia.org/show_bug.cgi?id=35760
lists.opensuse.org/archives/list/[email protected]/message/JSNIFYQRLND7PULS3ODEDTISSERCMKIQ
ubuntu.com/security/CVE-2025-9396
cve.org/CVERecord?id=CVE-2025-9396
suse.com/security/cve/CVE-2025-15570
bugzilla.suse.com/1248598