Description

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-05T12:16:45.450Z",
  "pubdate": "2026-09-05T12:16:45.450Z",
  "executiveSummary": "A heap-based buffer over-read vulnerability has been identified in ugrep versions prior to 7.6.0. The flaw resides within the application's LZW (Lempel-Ziv-Welch) decompression logic, which is utilized when processing compressed archive files with the .Z extension.\nThis vulnerability is triggered when the application parses a malformed or maliciously crafted .Z file. By providing specific input that violates expected decompression constraints, an attacker can force the LZW decompressor to perform an out-of-bounds memory read, accessing one byte beyond the boundaries of the allocated heap buffer.\nThe primary impact of this vulnerability is a denial-of-service (DoS) condition, as the out-of-bounds access typically results in an application crash (segmentation fault). While the current scope of the vulnerability is limited to potential crashes, heap-based memory corruption can theoretically lead to information disclosure or serve as a primitive for more complex exploit chains depending on the memory layout and surrounding application state.\nThe attack requires no authentication or elevated privileges, provided the attacker can convince a user or automated system to run ugrep against a malicious file. It is considered a significant risk for systems that automatically process untrusted archive content.",
  "technicalDetails": "The vulnerability originates from inadequate bounds checking within the ugrep LZW decompression routine. When ugrep processes .Z files, it employs a state machine to reconstruct the data stream based on LZW dictionary codes. The flaw manifests when the decompressor logic fails to validate the size of the output buffer against the current offset during a sequence expansion or dictionary index lookup.\nDuring the decompression of a crafted .Z archive, an attacker can manipulate the LZW stream to force the decompressor into an invalid state. Specifically, the implementation incorrectly calculates the remaining available space or the index pointer, causing the read operation to extend one byte past the heap buffer allocation. Because the memory access occurs outside the bounds of the heap chunk, the process encounters a memory violation.\nThe attack flow follows a structured sequence: First, the attacker generates a malicious .Z file designed to trigger the edge case in the LZW decompression algorithm. This file contains specific sequences that intentionally misalign the dictionary expansion or the byte-copy loop within the decompressor. Second, the attacker supplies this file to the ugrep utility, either by manual execution or through an automated pipeline that indexes or searches compressed archives. Third, as ugrep initializes the LZW decompression engine and begins processing the payload, the internal pointer is incremented to an address that resides outside the heap allocation boundary. Fourth, the attempt to read this memory location triggers a crash due to a hardware-level protection fault or heap integrity monitoring, effectively terminating the ugrep process.\nThis vulnerability is version-specific, affecting all releases of ugrep prior to 7.6.0. The root cause is categorized as an improper bounds check (CWE-125: Out-of-bounds Read) during the processing of untrusted, structured data. Because ugrep is often used in automated CI/CD pipelines, log analysis, or forensic toolkits, the exposure vector includes any system that performs automated search operations on external archive formats. While the current disclosure focuses on a one-byte over-read leading to a crash, the lack of input validation suggests that further analysis of the decompression routine is necessary to ensure no other memory management errors exist, such as potential integer overflows that could escalate the impact beyond a crash."
}