PT-2025-34574 · Ckolivas+1 · Lrzip+1

Xdcao · Published 2025-08-24 · Updated 2025-09-12 · CVE-2025-9396

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: ckolivas lrzip versions up to 0.651

Description: A security flaw exists in ckolivas lrzip up to version 0.651. The issue resides in the GI strtol l internal function within the strtol l.c file, leading to a null pointer dereference when manipulated. Exploitation requires local access. The exploit has been publicly released.

Recommendations: Update ckolivas lrzip to a version later than 0.651.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

CVE-2025-9396

Affected Products

Debian

Lrzip

References · 16

• 🔥 https://github.com/ckolivas/lrzip/issues/264 · Exploit
• 🔥 https://vuldb.com/?submit.632368 · Exploit
• 🔥 https://drive.google.com/file/d/1EFbiiM1d7Ozb0ucZt6zRO3ngU8ugUnCn/view?usp=sharing · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-9396 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-9396 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-9396 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-9396 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-9396 · Security Note
• https://ubuntu.com/security/CVE-2025-9396 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-9396 · Vendor Advisory
• https://t.me/CVEtracker/30809 · Telegram Post
• https://t.me/cveNotify/135349 · Telegram Post
• https://vuldb.com/?ctiid.321232 · Note
• https://vuldb.com/?id.321232 · Note
• https://t.me/cveNotify/133293 · Telegram Post