---
id: CVE-2025-15614
title: >-
  ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW
  decompressor when processing crafted .Z archive files
summary: >-
  ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW
  decompressor when processing crafted .Z archive files. Attackers can supply
  malformed .Z files that cause the decompressor to read one byte past the
  allocated h…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
cwe:
  - CWE-125
vendor: Genivia
product: ugrep
affected:
  - ugrep < 7.6.0
published: '2026-09-05'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:45.217'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15614'
references:
  - url: 'https://github.com/Genivia/ugrep'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Genivia/ugrep/blob/v7.5.0/src/zopen.c#L673'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Genivia/ugrep/commit/c12849a11264e2c81c860bf78ee9039772f307a4
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Genivia/ugrep/issues/511'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Genivia/ugrep/releases/tag/v7.6.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/ugrep-before-7.6.0-heap-buffer-over-read-via-z-decompression
    label: disclosure@vulncheck.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15614.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-15614'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-15614'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00116
epssPercentile: 0.01455
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T14:19:10.467174Z'
ingestedAt: '2026-09-06T07:51:56.735Z'
---

## Overview

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15614.json)