Vulnerability-Lookup

CVE-2025-15614 (GCVE-0-2025-15614)

Vulnerability from cvelistv5 – Published: 2026-09-05 11:37 – Updated: 2026-09-05 11:37

Title

ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression

Summary

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck mitre root

References

6 references

URL	Tags
https://github.com/Genivia/ugrep/issues/511	issue-tracking
https://github.com/Genivia/ugrep/commit/c12849a11…	patch
https://github.com/Genivia/ugrep/blob/v7.5.0/src/…	technical-description
https://github.com/Genivia/ugrep/releases/tag/v7.6.0	release-notes
https://github.com/Genivia/ugrep	product
https://www.vulncheck.com/advisories/ugrep-before…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Genivia	ugrep	Affected: 0 , < 7.6.0 (semver)	guessed

Date Public

2025-10-15 00:00

Credits

Vlatko Kosturjak

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/Genivia/ugrep",
          "product": "ugrep",
          "vendor": "Genivia",
          "versions": [
            {
              "lessThan": "7.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Vlatko Kosturjak"
        }
      ],
      "datePublic": "2025-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-05T11:37:59.256Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #511",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/Genivia/ugrep/issues/511"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Genivia/ugrep/commit/c12849a11264e2c81c860bf78ee9039772f307a4"
        },
        {
          "name": "Vulnerable getcode() read at src/zopen.c:673 (v7.5.0)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Genivia/ugrep/blob/v7.5.0/src/zopen.c#L673"
        },
        {
          "name": "ugrep v7.6.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/Genivia/ugrep/releases/tag/v7.6.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/Genivia/ugrep"
        },
        {
          "name": "VulnCheck Advisory: ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ugrep-before-7.6.0-heap-buffer-over-read-via-z-decompression"
        }
      ],
      "title": "ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-15614",
    "datePublished": "2026-09-05T11:37:59.256Z",
    "dateReserved": "2026-03-23T21:11:35.412Z",
    "dateUpdated": "2026-09-05T11:37:59.256Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-15614",
      "date": "2026-09-07",
      "epss": "0.00118",
      "percentile": "0.01894"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-15614\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2026-09-05T12:16:45.450\",\"lastModified\":\"2026-09-05T12:16:45.450\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.\"}],\"affected\":[{\"source\":\"disclosure@vulncheck.com\",\"affectedData\":[{\"vendor\":\"Genivia\",\"product\":\"ugrep\",\"defaultStatus\":\"unaffected\",\"packageURL\":\"pkg:github/Genivia/ugrep\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"7.6.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"references\":[{\"url\":\"https://github.com/Genivia/ugrep\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/Genivia/ugrep/blob/v7.5.0/src/zopen.c#L673\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/Genivia/ugrep/commit/c12849a11264e2c81c860bf78ee9039772f307a4\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/Genivia/ugrep/issues/511\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/Genivia/ugrep/releases/tag/v7.6.0\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://www.vulncheck.com/advisories/ugrep-before-7.6.0-heap-buffer-over-read-via-z-decompression\",\"source\":\"disclosure@vulncheck.com\"}]}}"
  }
}

FKIE_CVE-2025-15614

Vulnerability from fkie_nvd - Published: 2026-09-05 12:16 - Updated: 2026-09-05 12:16

Severity

3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	disclosure@vulncheck.com	https://github.com/Genivia/ugrep
	disclosure@vulncheck.com	https://github.com/Genivia/ugrep/blob/v7.5.0/src/zopen.c#L673
	disclosure@vulncheck.com	https://github.com/Genivia/ugrep/commit/c12849a11264e2c81c860bf78ee9039772f307a4
	disclosure@vulncheck.com	https://github.com/Genivia/ugrep/issues/511
	disclosure@vulncheck.com	https://github.com/Genivia/ugrep/releases/tag/v7.6.0
	disclosure@vulncheck.com	https://www.vulncheck.com/advisories/ugrep-before-7.6.0-heap-buffer-over-read-via-z-decompression

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/Genivia/ugrep",
          "product": "ugrep",
          "vendor": "Genivia",
          "versions": [
            {
              "lessThan": "7.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process."
    }
  ],
  "id": "CVE-2025-15614",
  "lastModified": "2026-09-05T12:16:45.450",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "disclosure@vulncheck.com",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-05T12:16:45.450",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/Genivia/ugrep"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/Genivia/ugrep/blob/v7.5.0/src/zopen.c#L673"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/Genivia/ugrep/commit/c12849a11264e2c81c860bf78ee9039772f307a4"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/Genivia/ugrep/issues/511"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/Genivia/ugrep/releases/tag/v7.6.0"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://www.vulncheck.com/advisories/ugrep-before-7.6.0-heap-buffer-over-read-via-z-decompression"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Primary"
    }
  ]
}

GHSA-85V4-HJ64-H8X4

Vulnerability from github – Published: 2026-09-05 12:31 – Updated: 2026-09-05 12:31

Details

Severity

3.3 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.8 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-15614"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-05T12:16:45Z",
    "severity": "MODERATE"
  },
  "details": "ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.",
  "id": "GHSA-85v4-hj64-h8x4",
  "modified": "2026-09-05T12:31:28Z",
  "published": "2026-09-05T12:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15614"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Genivia/ugrep/issues/511"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Genivia/ugrep/commit/c12849a11264e2c81c860bf78ee9039772f307a4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Genivia/ugrep"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Genivia/ugrep/blob/v7.5.0/src/zopen.c#L673"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Genivia/ugrep/releases/tag/v7.6.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/ugrep-before-7.6.0-heap-buffer-over-read-via-z-decompression"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

ubuntu-cve-2025-15614

Vulnerability from osv_ubuntu

Published

2026-09-07 00:00

Modified

2026-09-07 11:28

Summary

Details

(ugrep before 7.6.0 contains a heap buffer over-read vulnerability in t ...)

Severity

3.3 (Low)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.8 (Medium)


                    
                      CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-15614	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-15614	REPORT
	https://github.com/Genivia/ugrep/issues/511	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ugrep",
            "binary_version": "3.7.2+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "ugrep",
        "purl": "pkg:deb/ubuntu/ugrep@3.7.2+dfsg-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.3.6+dfsg-1",
        "3.3.8+dfsg-1",
        "3.3.9+dfsg-1",
        "3.3.10+dfsg-1",
        "3.5.0+dfsg-1",
        "3.6.0+dfsg-1",
        "3.7.1+dfsg-1",
        "3.7.2+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ugrep",
            "binary_version": "5.0.0+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "ugrep",
        "purl": "pkg:deb/ubuntu/ugrep@5.0.0+dfsg-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.12.7+dfsg-1",
        "4.3.1+dfsg-1",
        "4.3.2+dfsg-2",
        "4.3.2+dfsg-3",
        "4.3.3+dfsg-1",
        "4.3.4+dfsg-1",
        "4.3.6+dfsg-1",
        "4.4.1+dfsg-1",
        "4.5.2+dfsg-1",
        "5.0.0+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ugrep",
            "binary_version": "7.5.0+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "ugrep",
        "purl": "pkg:deb/ubuntu/ugrep@7.5.0+dfsg-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.4.2+dfsg-1",
        "7.5.0+dfsg-1"
      ]
    }
  ],
  "aliases": [],
  "details": "(ugrep before 7.6.0 contains a heap buffer over-read vulnerability in t ...)",
  "id": "UBUNTU-CVE-2025-15614",
  "modified": "2026-09-07T11:28:37Z",
  "published": "2026-09-07T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-15614"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-15614"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/Genivia/ugrep/issues/511"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-15614"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-15614 (GCVE-0-2025-15614)

FKIE_CVE-2025-15614

GHSA-85V4-HJ64-H8X4

ubuntu-cve-2025-15614

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature