Use-after-free in LZMA SDK - #VU111272

Vulnerability identifier: #VU111272

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Xz decompression module. A remote attacker can pass a specially crafted archive to the application and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

LZMA SDK
ClamAV
Secure Endpoint Connector for Linux
Secure Endpoint Connector for Mac
Secure Endpoint Private Cloud
Secure Endpoint Connector for Windows

Install updates from vendor's website.

LZMA SDK - update to 18.03 beta
ClamAV - addressed in versions 1.0.9, 1.4.3
Secure Endpoint Connector for Linux - update to 1.26.1
Secure Endpoint Connector for Mac - update to 1.26.1
Secure Endpoint Private Cloud - update to 4.2.2
Secure Endpoint Connector for Windows - addressed in versions 7.5.21, 8.4.5

• https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html

• Remote code execution in 7-zip LZMA SDK
• Multiple vulnerabilities in ClamAV
• Cisco Secure Endpoint Connectors update for ClamAV