CVE-2025-9396
MEDIUMCVSS 5.5/10EPSS 0.24%
Last modified
CVE-2025-9396 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ckolivas | Lrzip | <= 0.651 |
References
- https://github.com/ckolivas/lrzip/issues/264Exploit, Issue Tracking, Vendor Advisory
- https://vuldb.com/?ctiid.321232Permissions Required, VDB Entry
- https://vuldb.com/?id.321232Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.632368Exploit, Third Party Advisory, VDB Entry
- https://github.com/ckolivas/lrzip/issues/264Exploit, Issue Tracking, Vendor Advisory
- https://vuldb.com/?submit.632368Exploit, Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-9396?
A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited.
How severe is CVE-2025-9396?
CVE-2025-9396 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.24% probability of exploitation in the next 30 days.
How do I fix CVE-2025-9396?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-9390A security flaw has been discovered in vim up to 9.1.1615. A…5.5
- CVE-2025-9391A weakness has been identified in Bjskzy Zhiyou ERP up to 11…9.8
- CVE-2025-9392A security vulnerability has been detected in Linksys RE6250…8.8
- CVE-2025-9393A vulnerability was detected in Linksys RE6250, RE6300, RE63…8.8
- CVE-2025-9394A flaw has been found in PoDoFo 1.1.0-dev. This issue affect…5.5
- CVE-2025-9395A vulnerability was identified in wangsongyan wblog 0.0.1. T…6.3
- CVE-2025-9397A weakness has been identified in givanz Vvveb up to 1.0.7.2…9.8
- CVE-2025-9398A security vulnerability has been detected in YiFang CMS up …7.5
- CVE-2025-9399A vulnerability was detected in YiFang CMS up to 2.0.5. Affe…8.8
- CVE-2025-9400A flaw has been found in YiFang CMS up to 2.0.5. This affect…8.8
- CVE-2025-9401A vulnerability has been found in HuangDou UTCMS 9. This vul…3.7
- CVE-2025-9402A vulnerability was found in HuangDou UTCMS 9. This issue af…7.2
Are you affected by CVE-2025-9396?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST