The vulnerability CVE-2025-15570 in ckolivas lrzip version 0.651 is a use-after-free condition triggered by manipulation of the lzma_decompress_buf function in stream.c. This flaw requires local attacker privileges and low attack complexity. The vulnerability could potentially lead to undefined behavior or memory corruption. Although an exploit is publicly available, there is no official patch or vendor response at this time.

Successful exploitation of this use-after-free vulnerability may result in memory corruption, potentially leading to application crashes or other unintended behavior. The attack requires local access with low privileges and no user interaction, limiting remote exploitation. The CVSS score of 4.8 indicates a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should limit local access to trusted users and monitor for updates from the vendor. Avoid running lrzip version 0.651 in untrusted environments until a patch is available.