CVE-2023-39741 — lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/libzpaq.cpp

Back Back to CVE browser

MEDIUM

lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/libzpaq.cpp

Published Aug 17, 2023

5.5

MEDIUM

CVSS 3.1

EPSS 0.35%

Description

lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/libzpaq.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.35% 0.00346

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00346

Score over time

2023–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (8 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.35% (0.00346)	25.91th	v5 (v2026.06.15)
Jun 15, 2026	0.32% (0.00319)	23.38th	v5 (v2026.06.15)
Mar 17, 2025	0.08% (0.00081)	21.33th	v4 (v2025.03.14)
Dec 12, 2024	0.05% (0.00049)	20.78th	v3 (v2023.03.01)
Jun 12, 2024	0.04% (0.00044)	10.27th	v3 (v2023.03.01)
Aug 26, 2023	0.04% (0.00044)	8.27th	v3 (v2023.03.01)
Aug 24, 2023	0.04% (0.00044)	10.52th	v3 (v2023.03.01)
Aug 18, 2023	0.06% (0.00061)	23.82th	v3 (v2023.03.01)

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (3)

https://gist.github.com/huanglei3/ec9090096aa92445cf0a8baa8e929084
https://github.com/ckolivas/lrzip/issues/246
ExploitIssue Tracking
https://github.com/huanglei3/lrzip_poc/tree/main/lrzip_heap_overflow
Exploit

Link	Providers	Tags
https://gist.github.com/huanglei3/ec9090096aa92445cf0a8baa8e929084
https://github.com/ckolivas/lrzip/issues/246		ExploitIssue Tracking
https://github.com/huanglei3/lrzip_poc/tree/main/lrzip_heap_overflow		Exploit