Low severity · published Sep 5, 2026
CVE-2025-15614
ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UG
ugrep · Genivia
before 7.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15614
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15614
github.com
https://github.com/Genivia/ugrep
github.com
https://github.com/Genivia/ugrep/blob/v7.5.0/src/zopen.c#L673
github.com
https://github.com/Genivia/ugrep/commit/c12849a11264e2c81c860bf78ee9039772f307a4
github.com
https://github.com/Genivia/ugrep/issues/511
github.com
https://github.com/Genivia/ugrep/releases/tag/v7.6.0
www.vulncheck.com
https://www.vulncheck.com/advisories/ugrep-before-7.6.0-heap-buffer-over-read-via-z-decompression