{
  "cveId": "CVE-2025-9396",
  "url": "https://patchblox.com/security/cve/CVE-2025-9396",
  "summary": "CVE-2025-9396 is fixed in lrzip on 1 platform by OPENSUSE-SU-2026:21179-1 (version 0.660-bp160.1.1), released June 30, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "lrzip: This update for lrzip fixes the following issues:\n\nChanges in lrzip:\n\n- Update to version 0.660:\n  * Do not clean up...",
  "description": "This update for lrzip fixes the following issues:\n\nChanges in lrzip:\n\n- Update to version 0.660:\n  * Do not clean up thread structures in decompression failure\n    conditions, fixing a use-after-free in lzma_decompress_buf() and a\n    NULL pointer dereference in ucompthread() on corrupt/malicious\n    archives (CVE-2025-15570, boo#1258016; CVE-2025-15571, boo#1258023)\n  * Handle -L given without a parameter, fixing a NULL pointer\n    dereference (CVE-2025-9396, boo#1248598)\n  * Add write bounds checking in libzpaq and sanity checks for\n    maliciously encoded headers and oversized allocations\n  * Various STDIO, portability and build fixes (OpenBSD support,\n    non-x86 zpaq, autoconf warnings); drop Doxygen doc build",
  "published": "2026-06-30T11:29:53Z",
  "severity": "",
  "epss": 0.00284,
  "epssPercentile": 0.21005,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "lrzip",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.660-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:21179-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21179-1",
      "released": "2026-06-30T11:29:53Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}