Description
A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results in use after free. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ckolivas lrzip
0.651affected
References
- https://vuldb.com/?id.344926 ↗
- https://vuldb.com/?ctiid.344926 ↗
- https://vuldb.com/?submit.752595 ↗
- https://github.com/ckolivas/lrzip/issues/262 ↗
- https://github.com/user-attachments/files/21709004/PoC_UAF.zip ↗
- https://github.com/ckolivas/lrzip/ ↗
- https://lists.debian.org/debian-lts-announce/2026/05/msg00011.html ↗