Is there a patch available for CVE-2025-15614?

Yes, a patch is available for CVE-2025-15614. Update the affected software to the latest version immediately.

ugrep CVE-2025-15614

Q: What is the CVSS score of CVE-2025-15614?

CVE-2025-15614 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-210857 MEDIUM

Out-of-bounds Read (CWE-125)

2026-09-05 VulnCheck

GHSA-85v4-hj64-h8x4

Buffer Overflow Denial Of Service Ugrep Genivia

4.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.3 LOW

Local file processing requires user to invoke ugrep on the crafted file; no confidentiality or integrity impact, only a process crash (A:L).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Metadata Corrected

Sep 05, 2026 - 12:40 vuln.today

tag: Information Disclosure replaced by Denial Of Service

Source Code Evidence Fetched

Sep 05, 2026 - 12:25 vuln.today

Analysis Generated

Sep 05, 2026 - 12:25 vuln.today

DescriptionCVE.org

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.

AnalysisAI

Heap buffer over-read in ugrep before 7.6.0 allows a local attacker to crash the utility by supplying a malformed .Z (Unix compress) archive file to its LZW decompressor. The flaw, located in src/zopen.c at approximately line 673, causes the decompressor to read exactly one byte past the end of the allocated heap buffer, resulting in a process crash. The CVSS 4.0 vector confirms the impact is limited to availability at the Low severity level with no confidentiality or integrity exposure; no public exploit has been identified at time of analysis.

Technical ContextAI

ugrep is a fast, feature-rich grep utility developed by Genivia (CPE: cpe:2.3:a:genivia:ugrep:*:*:*:*:*:*:*:*) that supports searching within compressed archives including .Z files using the legacy LZW (Lempel-Ziv-Welch) compression algorithm. CWE-125 (Out-of-bounds Read) describes the root cause: an off-by-one error in the LZW decompressor's boundary arithmetic allows it to read one byte beyond the end of the allocated heap buffer. The vulnerable code is in src/zopen.c at line 673. The fix was introduced in v7.6.0 via commit c12849a11264e2c81c860bf78ee9039772f307a4; however, the commit diff provided shows primarily zsh completion file changes rather than the actual src/zopen.c patch, so the precise corrective code change is not independently verifiable from the supplied data.

RemediationAI

Upgrade ugrep to version 7.6.0 or later, which resolves the heap buffer over-read via commit c12849a11264e2c81c860bf78ee9039772f307a4. The release is available at https://github.com/Genivia/ugrep/releases/tag/v7.6.0. If immediate upgrade is not feasible, a practical compensating control is to prohibit ugrep from processing .Z archive files sourced from untrusted external inputs, since the vulnerable LZW decompressor code path is triggered exclusively by that file format. Wrapper scripts or CI/CD pipeline policies can enforce this by filtering or rejecting .Z file extensions before ugrep invocation; the trade-off is loss of compressed-archive search capability for .Z files until the upgrade is applied.