{"id":"CVE-2025-15571","aliases":["DEBIAN-CVE-2025-15571","EUVD-2025-207261","GHSA-x954-5gxx-h6v4","UBUNTU-CVE-2025-15571","openSUSE-SU-2026:21179-1"],"status":"published","title":"ckolivas lrzip stream.c ucompthread null pointer dereference","description":"A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00189,"percentile":0.08628,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-404","CWE-476"],"published":"2026-02-10T14:32:08Z","modified":"2026-10-28T02:30:30Z","fixes":[{"ecosystem":"Debian:14","package":"lrzip","fixed_in":["0.660-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.651-2","0.651-3","0.660-1"]},{"source":"osv","ecosystem":"Debian:13","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.651-3","0.660-1"]},{"source":"osv","ecosystem":"Debian:14","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.660-1"}]}],"versions":["0.651-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.608-2","0.616-1","0.616-1ubuntu0.1~esm","0.616-1ubuntu0.1~esm1","0.616-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.621-1","0.621-1ubuntu0.1~esm1","0.621-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.631-1","0.631-1ubuntu0.1~esm1","0.631-1+deb9u1build0.18.04.1","0.631-1+deb9u3build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.631+git180528-1","0.631+git180528-1build1","0.631+git180528-1+deb10u1build0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.641-1","0.651-2","0.651-2ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.651-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.651-2ubuntu1","0.651-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.660-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.651-3","0.651-3build1","0.660-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"lrzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.660-bp160.1.1"}]}],"bundled":3}],"products":[{"vendor":"ckolivas","product":"lrzip"}],"references":[{"url":"https://vuldb.com/?id.344931","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://vuldb.com/?ctiid.344931","tags":["signature","permissions-required","Permissions Required","VDB Entry","report"]},{"url":"https://vuldb.com/?submit.752603","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://github.com/ckolivas/lrzip/issues/263","tags":["issue-tracking","Exploit","Issue Tracking","report"]},{"url":"https://github.com/user-attachments/files/21726331/PoC_NPD.zip","tags":["exploit","Exploit","evidence","report"]},{"url":"https://github.com/ckolivas/lrzip/","tags":["product","Product","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15571","tags":["advisory"]},{"url":"https://github.com/ckolivas/lrzip"},{"url":"https://github.com/advisories/GHSA-x954-5gxx-h6v4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15571.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-15571","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-15571","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15571","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248598","tags":["report"]},{"url":"https://bugzilla.suse.com/1258016","tags":["report"]},{"url":"https://bugzilla.suse.com/1258023","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9396","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-15571","title":"ckolivas lrzip stream.c ucompthread null pointer dereference","description":"A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","status":"published","published":"2026-02-10T14:32:08.345Z","modified":"2026-02-23T09:56:32.516Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R","level":"low","assessor":"cna"},{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R","level":"low","assessor":"cna"},{"version":"2.0","score":1.7,"vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR","assessor":"cna"}],"cwes":["CWE-476","CWE-404"],"updated_at":"2026-11-02T14:32:37.351404Z"}],"euvd":[{"id":"EUVD-2025-207261","description":"A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","status":"published","published":"2026-02-10T14:32:08Z","modified":"2026-02-23T09:56:32Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:48:33.144691Z"}],"ghsa":[{"id":"GHSA-x954-5gxx-h6v4","title":"A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability...","description":"A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","status":"published","published":"2026-02-10T15:30:28Z","modified":"2026-02-27T18:32:02Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-404","CWE-476"],"updated_at":"2026-11-02T15:06:24.663603Z"}],"nvd":[{"id":"CVE-2025-15571","description":"A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","status":"published","published":"2026-02-10T15:16:04.443Z","modified":"2026-06-17T08:38:03.13Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":1.7,"vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","level":"low","assessor":"secondary"}],"cwes":["CWE-404","CWE-476"],"updated_at":"2026-11-02T14:11:59.832225Z"}],"osv":[{"id":"CVE-2025-15571","title":"ckolivas lrzip stream.c ucompthread null pointer dereference","description":"A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","status":"published","published":"2026-02-10T14:32:08.345Z","modified":"2026-10-28T02:30:30.849786914Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-404","CWE-476"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DEBIAN-CVE-2025-15571","description":"A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","status":"published","published":"2026-02-10T15:16:04.443Z","modified":"2026-09-01T20:05:41.482963758Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"UBUNTU-CVE-2025-15571","description":"A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","status":"published","published":"2026-02-10T15:16:00Z","modified":"2026-10-17T12:56:48.324299445Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"openSUSE-SU-2026:21179-1","title":"Security update for lrzip","description":"This update for lrzip fixes the following issues:\n\nChanges in lrzip:\n\n- Update to version 0.660:\n  * Do not clean up thread structures in decompression failure\n    conditions, fixing a use-after-free in lzma_decompress_buf() and a\n    NULL pointer dereference in ucompthread() on corrupt/malicious\n    archives (CVE-2025-15570, boo#1258016; CVE-2025-15571, boo#1258023)\n  * Handle -L given without a parameter, fixing a NULL pointer\n    dereference (CVE-2025-9396, boo#1248598)\n  * Add write bounds checking in libzpaq and sanity checks for\n    maliciously encoded headers and oversized allocations\n  * Various STDIO, portability and build fixes (OpenBSD support,\n    non-x86 zpaq, autoconf warnings); drop Doxygen doc build\n","status":"published","published":"2026-06-30T11:29:53Z","modified":"2026-07-02T18:24:18.175989238Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}