CVE-2025-15614: ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ugrep versions before 7.6.0 are affected when they process .Z archive files. The issue is in the LZW decompressor used for .Z input.
What does an attacker need to exploit this?
An attacker needs to cause ugrep to process a crafted malformed .Z file. The provided severity vector indicates local access and user interaction are required; no privileges are required.
What is the likely impact?
The out-of-bounds read is one byte past an allocated heap buffer and may crash the ugrep process. The supplied data does not indicate confidentiality or integrity impact.
What can be done if upgrading is not immediately possible?
Avoid processing untrusted .Z archive files with affected ugrep versions until version 7.6.0 or later can be deployed.