This vulnerability affects lrzip up to version 0.651 in the lzma_decompress_buf function of stream.c. It allows a local attacker with low privileges to trigger a use-after-free condition by manipulating input to the decompression buffer. The vulnerability does not require user interaction and has a low complexity attack vector. The project was notified early but has not provided a fix or response, and no official patch or remediation is currently available.

An attacker with local access and low privileges can exploit this vulnerability to cause a use-after-free condition, potentially leading to application crashes or undefined behavior. The CVSS score of 4.8 reflects a medium impact, with limited scope and complexity. There is no evidence of remote exploitation or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should avoid running untrusted code or inputs through lrzip version 0.651. Monitor official project channels for updates and apply any future patches promptly.