CVE-2025-15571

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404 CWE-476

Affected software

Vendor	Product	Versions
ckolivas	lrzip	0.651

References

https://github.com/ckolivas/lrzip/Product
https://github.com/ckolivas/lrzip/issues/263Exploit, Issue Tracking
https://github.com/user-attachments/files/21726331/PoC_NPD.zipExploit
https://vuldb.com/?ctiid.344931Permissions Required, VDB Entry
https://vuldb.com/?id.344931Third Party Advisory, VDB Entry
https://vuldb.com/?submit.752603Third Party Advisory, VDB Entry

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-155725.5A vulnerability has been found in wasm3 up to 0.5.0. The affected element is the function NewCodePage. The manipulation leads to memory leak CVE-2025-155739.4The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqt CVE-2025-155746.5When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character string printed on the So CVE-2025-155755.3The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash mal CVE-2025-155767.5If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancest CVE-2025-155777.5An unauthenticated attacker can exploit this vulnerability by manipulating URL to achieve arbitrary file read access.This issue affects Valm CVE-2025-155789.8Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is a CVE-2025-155799.5Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to r CVE-2025-15586.5Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the CVE-2025-155814.7Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. CVE-2025-155828.1A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Pro CVE-2025-155835.4A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. E