A heap buffer over-read flaw exists in the LZW decompressor used by ugrep before version 7.6.0 when handling .Z archive files. Malformed .Z files can cause the decompressor to read one byte past a heap‑allocated buffer, which may result in a process crash and a denial of service. The weakness is classified as CWE-125.

The vulnerability affects Genivia ugrep versions earlier than 7.6.0. The specific upstream release prior to the fix is 7.5.0 and any earlier build that still includes the original LZW decompression implementation.

The CVSS score of 4.8 indicates moderate severity. EPSS data is not provided, and the issue is not listed in the CISA KEV catalog, meaning no confirmed active exploitation is reported. An attacker would need to supply a crafted .Z file to a system running ugrep, which could be achieved locally or remotely if the application accepts user‑supplied archive files. The exploitation would likely result only in a service crash and not in arbitrary code execution or data disclosure.