Junglewise Threat Intelligence

CVE-2025-15614: ugrep heap buffer over-read in LZW decompressor

CVE-2025-15614 · Severity: low · CVSS 3.3 · Published 2026-09-05

Executive brief

ugrep is a popular file search utility that supports searching across archived and compressed files, including .Z (compress) format archives. A heap buffer over-read vulnerability in the LZW decompressor allows an attacker to craft a malicious .Z file that causes the decompression routine to read one byte past the allocated buffer, potentially crashing the application. This could disrupt operations for users relying on ugrep for file searching and analysis.

Technical details

The vulnerability is a heap buffer over-read in the LZW decompressor (zopen.c) when processing crafted .Z archive files. The root cause is improper bounds checking in the decompression logic that fails to validate buffer access before reading compressed data. An attacker can supply a malformed .Z file that triggers the out-of-bounds read. The attack vector is file-based and requires no authentication; an attacker simply needs to trick a user into processing a malicious .Z file with ugrep. Exploitation results in a denial-of-service condition (crash). The vulnerability was fixed in version 7.6.0.

Affected products

  • Genivia ugrep before 7.6.0

Timeline

  • 2026-09-05: disclosed
  • 2026-01-01: patched: Fixed in version 7.6.0

References