CVE-2025-15570

low-risk

Published 2026-02-10

A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results in use after free. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Do I need to act?

0.01% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Lrzip

Affected Vendors

Ckolivas

References (6)

Product https://github.com/ckolivas/lrzip/

Exploit https://github.com/ckolivas/lrzip/issues/262

Exploit https://github.com/user-attachments/files/21709004/PoC_UAF.zip

Permissions Required https://vuldb.com/?ctiid.344926

Third Party Advisory https://vuldb.com/?id.344926

Third Party Advisory https://vuldb.com/?submit.752595

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal