CVE-2025-9396 ckolivas lrzip strtol_l.c GI___strtol_l_internal null pointer dereference

Medium 4.8 Published 24 Aug 2025 Updated 25 Aug 2025

A local attacker can cause a denial of service in lrzip via a null pointer dereference in the strtol_l_internal function.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-9396?

CVE-2025-9396 is a medium-severity vulnerability in ckolivas lrzip, published on 24 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited.

Weakness: CWE-476, CWE-404

Which versions are affected by CVE-2025-9396?

It affects 1 product.

Products include Ckolivas Lrzip.

How do I fix CVE-2025-9396?

No fix published yet.

Is CVE-2025-9396 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-9396 exists.

Sources

Also known as DEBIAN-CVE-2025-9396, GHSA-7p5p-5c63-6f3w, UBUNTU-CVE-2025-9396.

CVE-2025-9396 ckolivas lrzip strtol_l.c __GI_____strtol_l_internal null pointer dereference