Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2025-15614: ugrep can crash on malicious .Z files
CVE-2025-15614 · published 2 months ago
Summary
Versions of ugrep older than 7.6.0 may read beyond allocated memory when decompressing specially crafted .Z archive files. This can cause the program to stop working unexpectedly. Upgrade ugrep to version 7.6.0 or later to prevent the issue.
What to do
- Update debian ugrep to version 7.6.0+dfsg-1.
- Update genivia ugrep to version 7.6.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:22.04:LTS | canonical | ugrep | All versions |
| – | genivia | ugrep | < 7.6.0 |
| Debian:12 | debian | ugrep | All versions |
| Debian:14 | debian | ugrep |
< 7.6.0+dfsg-1 Fix: upgrade to 7.6.0+dfsg-1
|
Original advisory text
ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
References
- https://security-tracker.debian.org/tracker/CVE-2025-15614 Vendor Advisory
- https://ubuntu.com/security/CVE-2025-15614 Third Party Advisory
- https://github.com/Genivia/ugrep/issues/511 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-15614 Third Party Advisory
- https://github.com/Genivia/ugrep/releases/tag/v7.6.0 Vendor Advisory
- https://www.vulncheck.com/advisories/ugrep-before-7.6.0-heap-buffer-over-read-vi... Vendor Advisory
- https://github.com/Genivia/ugrep/commit/c12849a11264e2c81c860bf78ee9039772f307a4 Patch
- https://github.com/Genivia/ugrep Product
- https://github.com/Genivia/ugrep/blob/v7.5.0/src/zopen.c#L673 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15614... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-15614 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.8
Medium
Type
CWE-125Out-of-bounds Read
Timeline
Published5 Sep 2026
Updated4 Nov 2026
First seen5 Sep 2026
Sources
CVE-2025-15614 · NVD
CVE-2025-15614 · MITRE
CVE-2025-15614 · OSV
DEBIAN-CVE-2025-15614 · OSV
UBUNTU-CVE-2025-15614 · OSV
Track software like this
Free during beta