CVE-2025-15570: 
NixOS vulnerability analysis and mitigation

CVE-2025-15570 is a concurrency use-after-free (UAF) vulnerability in lrzip (Long Range ZIP) up to and including version 0.651, specifically in the lzma_decompress_buf function within stream.c. The flaw arises from a race condition between the clear_rulist and lzma_decompress_buf functions during multithreaded decompression. It was reported via a GitHub issue on August 12, 2025, and published to NVD on February 10, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High), requiring only local access and low privileges to exploit (Red Hat CVE, GitHub Issue).

The root cause is a concurrency race condition (CWE-416: Use After Free, CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) between two functions: clear_rulist in lrzip.c frees sinfo->ucthreads, while lzma_decompress_buf in stream.c concurrently accesses the same memory region via ucthread->s_buf = c_buf. This results in a heap-use-after-free write, confirmed by AddressSanitizer (ASAN) output showing a WRITE of size 8 at a freed heap region. Exploitation requires local access with low privileges and the use of at least two processing threads (-p2 flag), and a crafted .lrz archive file is used as the trigger. The reporter notes this may be an incomplete fix of a prior related issue (#206) (GitHub Issue).

Successful exploitation can lead to memory corruption, potentially enabling information disclosure, data integrity violations, or application crashes (denial of service). The reporter assessed that a carefully crafted exploit could allow arbitrary code execution, as the UAF write occurs in a heap region accessible by a worker thread. The vulnerability is scoped to the local system and does not directly enable network-based lateral movement, but could be leveraged for privilege escalation in multi-user environments where lrzip is used to process untrusted archives (GitHub Issue, Red Hat CVE).

A public proof-of-concept (PoC) exploit — including a crafted PoC_UAF archive file and reproduction instructions — has been published on GitHub (PoC ZIP, GitHub Issue). The EPSS score is very low at 0.005%, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The CVSS v4.0 base score is 1.9 (Low), reflecting the constrained local attack surface (Red Hat CVE).

1. Prepare the environment: Obtain a system with lrzip ≤ 0.651 installed and local user access with low privileges.
2. Obtain or craft a malicious archive: Download or use the published PoC archive (PoC_UAF) from the GitHub issue, which is specifically crafted to trigger the race condition during decompression (GitHub Issue).
3. Trigger multithreaded decompression: Execute lrzip with at least two threads to enable the concurrent execution path: ./lrzip -t -p2 ./PoC_UAF. The -p2 flag spawns multiple decompression threads, creating the race window between clear_rulist and lzma_decompress_buf.
4. Race condition triggers UAF: During decompression, clear_rulist frees sinfo->ucthreads while a worker thread (T3) concurrently writes to ucthread->s_buf within lzma_decompress_buf, resulting in a heap-use-after-free write.
5. Achieve impact: Depending on heap layout and timing, the outcome ranges from a crash (denial of service) to potential memory corruption that could be further developed into arbitrary code execution with a more refined exploit (GitHub Issue).

• Process: Unexpected crashes or aborts of the lrzip process, particularly when using multi-threaded decompression (-p2 or higher); ASAN/UBSAN error output referencing stream.c:562 or lrzip.c:786 in debug builds.
• File System: Presence of unusual or crafted .lrz archive files in user-accessible directories, especially files that consistently cause lrzip to crash or behave abnormally.
• Logs: System logs (e.g., /var/log/syslog) showing segmentation faults or abnormal termination of lrzip processes; core dump files generated by lrzip in working directories.
• Network: No network-based IOCs are expected, as this is a local exploitation vector.

No official patch has been released by the lrzip project maintainer as of the time of disclosure; the project was notified via GitHub issue #262 but has not responded. A Debian LTS advisory (DLA-4567-1) was issued in May 2026, addressing this and related vulnerabilities for Debian LTS users — users on affected Debian systems should apply the available package update (Linux Security). As interim mitigations: restrict local system access and user privileges to minimize attack surface; avoid using lrzip to decompress untrusted archives, especially with multi-threaded options (-p2 or higher); and monitor for lrzip crashes in sensitive environments. Users should watch the lrzip GitHub repository for an upstream fix.

Red Hat has acknowledged the vulnerability and published a CVE tracking page, though no Red Hat products are listed as directly affected (Red Hat CVE). Debian issued a Long Term Support security advisory (DLA-4567-1) in May 2026 addressing lrzip vulnerabilities including CVE-2025-15570 (Linux Security). The upstream project maintainer has not publicly responded to the GitHub issue report as of disclosure. Tenable published Nessus detection plugins (IDs 298653 and 313010) for this vulnerability (Tenable).