CVE catalog

CVE-2025-15570

lrzip: CVE-2025-15570

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Feb 10, 2026, 2:16:07 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.23% · Oct 25, 2026

A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results in use after free. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	lrzip	sid	`0.660-1`	fixed
Debian	lrzip	forky	`0.660-1`	fixed
Debian	lrzip	trixie	`0.651-3`	vulnerable
Debian	lrzip	bookworm	`0.651-2`	vulnerable
Opensuse	lrzip	leap 16.0	`0.660-bp160.1.1`	fixed
Opensuse	lrzip	tumbleweed	`0.660-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	lrzip	source	sid	`0.660-1`	not yet assigned	Not reported	[1128069]
Debian	lrzip	source	forky	`0.660-1`	not yet assigned	Not reported	[1128069]
Debian	lrzip	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1128069]
Debian	lrzip	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1128069]
Opensuse	lrzip	rpm	leap 16.0	`0.660-bp160.1.1`	Not reported	OPENSUSE-SU-2026:21179-1	Not reported
Opensuse	lrzip	rpm	tumbleweed	`0.660-1.1`	Not reported	OPENSUSE-SU-2026:11093-1	Not reported

[Debian bug #1128069]

Notes

[trixie] lrzip: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[lrzip]Affected
Details (2)
- 0.651-2 · amd64 · bookworm
  Affected
  dsa · lrzip · debian · bookworm; dsa · lrzip · debian · 12
- 0.651-2 · arm64 · bookworm
  Affected
  dsa · lrzip · debian · bookworm; dsa · lrzip · debian · 12

[Debian 13 (Trixie)]

[lrzip]Affected
Source package: [lrzip]
Details (2)
- 0.651-3 · amd64 · trixie
  Affected
  dsa · lrzip · debian · 13
- 0.651-3+b1 · arm64 · trixie
  Affected
  dsa · lrzip · debian · 13

[openSUSE Tumbleweed]

[lrzip]Fixed
Source package: [lrzip]
Details (1)
- 0.660-1.3 · x86_64 · tumbleweed
  Fixed · Fixed: 0.660-1.1
  dsa · lrzip · opensuse · tumbleweed

Observed: Oct 24, 2026, 12:53:30 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]