CVE-2025-15614
lowugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files.
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
CVSS
3.3
3.3 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-09-05 12:16
Modified: 2026-10-19 22:10
NVD status: Deferred
Last synced 1 day ago
Verified against the source API 2026-10-27 06:50 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/Genivia/ugrep disclosure@vulncheck.com
- https://github.com/Genivia/ugrep/blob/v7.5.0/src/zopen.c#L673 disclosure@vulncheck.com
- https://github.com/Genivia/ugrep/commit/c12849a11264e2c81c860bf78ee9039772f307a4 disclosure@vulncheck.com
- https://github.com/Genivia/ugrep/issues/511 disclosure@vulncheck.com
- https://github.com/Genivia/ugrep/releases/tag/v7.6.0 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/ugrep-before-7.6.0-heap-buffer-over-read-via-z-decomp... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:50 UTC · record ↗