Executive brief
ugrep is a popular file search utility that supports searching across archived and compressed files, including .Z (compress) format archives. A heap buffer over-read vulnerability in the LZW decompressor allows an attacker to craft a malicious .Z file that causes the decompression routine to read one byte past the allocated buffer, potentially crashing the application. This could disrupt operations for users relying on ugrep for file searching and analysis.
Technical details
The vulnerability is a heap buffer over-read in the LZW decompressor (zopen.c) when processing crafted .Z archive files. The root cause is improper bounds checking in the decompression logic that fails to validate buffer access before reading compressed data. An attacker can supply a malformed .Z file that triggers the out-of-bounds read. The attack vector is file-based and requires no authentication; an attacker simply needs to trick a user into processing a malicious .Z file with ugrep. Exploitation results in a denial-of-service condition (crash). The vulnerability was fixed in version 7.6.0.
Affected products
- Genivia ugrep before 7.6.0
Timeline
- 2026-09-05: disclosed
- 2026-01-01: patched: Fixed in version 7.6.0