CVE-2025-9396: 
NixOS vulnerability analysis and mitigation

A security vulnerability (CVE-2025-9396) was discovered in ckolivas lrzip versions up to 0.651, affecting the function GI___strtollinternal in the file strtol_l.c. The vulnerability was disclosed on August 24, 2025, and involves a null pointer dereference that can be triggered through local access (NVD, VulDB).

The vulnerability is classified as a null pointer dereference (CWE-476) occurring in the command line argument parsing functionality. The issue manifests when the program attempts to convert a string argument to an integer using strtol at line 440 in main.c, which internally calls GI___strtollinternal. The vulnerability has received a CVSS v3.1 base score of 3.3 (Low) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (GitHub Issue).

The vulnerability affects system availability by causing a program crash through a null pointer dereference. The attack is restricted to local execution and requires low privileges. There is no impact on confidentiality or integrity of the system (VulDB).

No official patches or mitigations have been published at the time of disclosure. It is recommended to replace the affected software with an alternative product until a fix becomes available (VulDB).