CVE-2025-15614: ugrep Buffer Overflow Vulnerability

CVE-2025-15614 Overview

CVE-2025-15614 is a heap buffer over-read vulnerability in the ugrep file search utility before version 7.6.0. The flaw resides in the LZW decompressor logic used to process .Z archive files. When ugrep parses a maliciously crafted .Z file, the decompressor reads one byte past the end of an allocated heap buffer. This out-of-bounds read can crash the process, resulting in a denial of service condition on the local host.

The vulnerability is classified as an Out-of-Bounds Read weakness [CWE-125]. Exploitation requires user interaction, typically by invoking ugrep against an attacker-supplied .Z archive.

Critical Impact
A crafted .Z file processed by vulnerable ugrep versions triggers a one-byte heap over-read in the LZW decompressor, potentially crashing the process and disrupting local search operations or automated pipelines.

Affected Products

Genivia ugrep versions prior to 7.6.0
ugrep builds linking the vulnerable zopen.c LZW decompression routine
Downstream distributions packaging ugrep releases earlier than 7.6.0

Discovery Timeline

2026-09-05 - CVE-2025-15614 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2025-15614

Vulnerability Analysis

The defect exists in the LZW (Lempel-Ziv-Welch) decompression routine implemented in src/zopen.c. ugrep uses this routine to transparently decompress .Z archives when searching their contents. A malformed .Z file can steer the decoder into reading a single byte immediately after the allocated output buffer on the heap.

Because the read passes the heap boundary, it can access unmapped memory or trigger heap sanitizers, causing the process to abort. The condition maps to Out-of-Bounds Read [CWE-125]. The impact is limited to availability of the local ugrep process; no memory contents are written and no code execution has been demonstrated.

Root Cause

The root cause is missing bounds validation in the LZW code-to-byte expansion loop inside zopen.c around the code path referenced in the upstream source at line 673 of the v7.5.0 tree. When a crafted .Z stream produces an over-long decoded sequence, the decompressor advances one position beyond the allocated buffer before the terminating check is applied. See the ugrep source at zopen.c for the pre-patch implementation.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted .Z file to the victim, then relies on the victim (or an automated job) to run ugrep against that file or a directory containing it. The vulnerability does not require elevated privileges. The result is a process crash of ugrep, which can disrupt build pipelines, log-processing jobs, or interactive searches that iterate across untrusted archives.

See the upstream discussion in the ugrep issue tracker and the VulnCheck advisory for technical details on the malformed .Z structure that triggers the over-read.

Detection Methods for CVE-2025-15614

Indicators of Compromise

Unexpected ugrep process crashes or abort signals (SIGABRT, SIGSEGV) recorded in system journals or CI logs when scanning directories containing .Z files.
Presence of unfamiliar or untrusted .Z archives in paths recursively searched by ugrep.
Heap sanitizer or AddressSanitizer reports referencing zopen.c when running instrumented builds.

Detection Strategies

Inventory installed ugrep binaries across endpoints and servers and compare reported versions against 7.6.0 using package metadata or ugrep --version.
Alert on repeated non-zero exit codes from ugrep invocations in CI/CD, log parsing, and backup workflows.
Correlate core dump generation events with .Z files being present in the scanned working directory.

Monitoring Recommendations

Enable core dump collection for ugrep and forward metadata to a central log store for triage.
Monitor package management events for ugrep installations and upgrades to confirm rollout of the fixed version.
Flag ingestion of externally sourced .Z archives into shared filesystems that are searched by automated jobs.

How to Mitigate CVE-2025-15614

Immediate Actions Required

Upgrade all instances of ugrep to version 7.6.0 or later, as published in the ugrep v7.6.0 release.
Audit CI/CD pipelines and scheduled jobs that invoke ugrep against untrusted content and pause them until patched binaries are deployed.
Restrict write access to directories that ugrep recursively scans, preventing untrusted users from placing crafted .Z files.

Patch Information

The fix is delivered in Genivia ugrep 7.6.0. The upstream repair is tracked in the ugrep commit c12849a which resolves issue #511. Rebuild or repackage downstream distributions from the 7.6.0 tag to inherit the corrected LZW decompression bounds handling.

Workarounds

Disable transparent decompression by avoiding ugrep's -z / --decompress option when scanning untrusted trees on unpatched hosts.
Pre-filter input directories to exclude .Z files (for example, using --exclude='*.Z') until the upgrade is applied.
Run ugrep under a restricted, non-privileged account with resource limits so that a crash cannot disrupt privileged workflows.

bash

# Configuration example: verify version and exclude .Z files as a temporary workaround
ugrep --version

# Recursive search excluding compressed .Z archives until upgrade to 7.6.0
ugrep -r --exclude='*.Z' 'pattern' /path/to/data