CVE-2025-15571: A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such…

PriorityP422medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.16%

5.4th percentile

A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
ckolivas	lrzip	<= 0.651	—
ckolivas	lrzip	—	—
ckolivas	lrzip	>= 0 < 0.660-1	0.660-1
debian	lrzip	< lrzip 0.660-1 (forky)	lrzip 0.660-1 (forky)

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.01.7LOWAV:L/AC:L/Au:S/C:N/I:N/A:P

osv4.8MEDIUM

vendor_debian4.8MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.