CVE-2025-15614
ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression
- State
- Published
- Severity
- 4.8 Medium
- Published
- Sep 5, 2026
- Updated
- Sep 24, 2026
- Reserved
- Mar 23, 2026
Description
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 3.3 Low | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L | VulnCheck |
Weaknesses
- CWE-125 Out-of-bounds Read
Affected Products
| Product | Versions |
|---|---|
ugrepGenivia |
|
References
- GitHub Issue #511issue-tracking
- Patch Commitpatch
- Vulnerable getcode() read at src/zopen.c:673 (v7.5.0)technical-description
- ugrep v7.6.0 Release Notesrelease-notes
- https://github.com/Genivia/ugrepproduct
- VulnCheck Advisory: ugrep before 7.6.0 Heap Buffer Over-read via .Z decompressionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.