CVE-2025-15570
Medium · 5.3CVSS
5.3
EPSS
0.2%
Published
Feb 10, 2026
CISA due date
—
The record
A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results in use after free. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | lrzip | 0 | 0.660-bp160.1.1 |
| openSUSE:Tumbleweed | lrzip | 0 | 0.660-1.1 |
Related vulnerabilities
- CVE-2025-15571 A security vulnerability has been detected in ckolivas lrzip up to 0.651. Also affects lrzip
- CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. CWE-119
- CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-119
- CVE-2026-90831 A vulnerability was detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90803 A security vulnerability has been detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90801 A security flaw has been discovered in GNU Binutils 2.47. CWE-119
- CVE-2026-87933 A vulnerability was found in DaveGamble cJSON up to 1.7.19. CWE-119