Log in Start free

Vulnerability · Published Feb 10, 2026 · Assigned by VulDB

CVE-2025-15570ckolivas lrzip stream.c lzma_decompress_buf use after free

Medium 5.3

In plain English

A medium-severity use-after-free in lrzip from ckolivas. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 86.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results in use after free. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12lrzipno fix listedDEBIAN-CVE-2025-15570
Debian:13lrzipno fix listedDEBIAN-CVE-2025-15570
Debian:14lrzip0.660-1DEBIAN-CVE-2025-15570
Ubuntu:22.04:LTSlrzipno fix listedUBUNTU-CVE-2025-15570
Ubuntu:24.04:LTSlrzipno fix listedUBUNTU-CVE-2025-15570
Ubuntu:25.10lrzipno fix listedUBUNTU-CVE-2025-15570
Ubuntu:26.04:LTSlrzipno fix listedUBUNTU-CVE-2025-15570
Ubuntu:26.10lrzipno fix listedUBUNTU-CVE-2025-15570

Affected products (as reported)

VendorProductVersions
ckolivas lrzip 0.651

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References