CVE catalog

CVE-2025-15571

lrzip: CVE-2025-15571

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.18% · Oct 25, 2026

A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlrzipsid0.660-1fixed
Debianlrzipforky0.660-1fixed
Debianlrziptrixie0.651-3vulnerable
Debianlrzipbookworm0.651-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlrzipsourcesid0.660-1not yet assignedNot reported[1128070]
Debianlrzipsourceforky0.660-1not yet assignedNot reported[1128070]
Debianlrzipsourcetrixie(unfixed)not yet assignedNot reported[1128070]
Debianlrzipsourcebookworm(unfixed)not yet assignedNot reported[1128070]

[Debian bug #1128070]

Notes

[trixie] lrzip: Minor issue, revisit when fixed upstream [bookworm] lrzip: Minor issue, revisit when fixed upstream

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [lrzip]Affected
    Details (2)

    • 0.651-2 · amd64 · bookworm

      Affected

      dsa · lrzip · debian · bookworm; dsa · lrzip · debian · 12

    • 0.651-2 · arm64 · bookworm

      Affected

      dsa · lrzip · debian · bookworm; dsa · lrzip · debian · 12

[Debian 13 (Trixie)]

  • [lrzip]Affected

    Source package: [lrzip]

    Details (2)

    • 0.651-3 · amd64 · trixie

      Affected

      dsa · lrzip · debian · 13

    • 0.651-3+b1 · arm64 · trixie

      Affected

      dsa · lrzip · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]