Advisories » MGASA-2026-0495

Updated ugrep package fixes a security vulnerability

Publication date: 12 Oct 2026
Modification date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2025-15614

Description

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the
LZW decompressor when processing crafted .Z archive files. Attackers can
supply malformed .Z files that cause the decompressor to read one byte
past the allocated heap buffer, potentially crashing the process.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36487
• https://github.com/Genivia/ugrep/issues/511
• https://github.com/Genivia/ugrep/releases/tag/v7.6.0
• https://www.cve.org/CVERecord?id=CVE-2025-15614

SRPMS

10/core

• ugrep-7.8.5-1.mga10