Security readout for executives and security teams
Plain-English summary
lrzip 0.631 can get stuck in an endless processing loop when handling a specially crafted .lrz archive. The direct business risk is denial of service: systems or workflows that automatically unpack untrusted lrzip files may hang or consume resources until stopped.
Executive priority
Prioritize if lrzip is used in internet-facing upload, email, backup, or analysis pipelines. Otherwise handle as routine vulnerability management with focus on removing untrusted automatic decompression paths.
Technical view
CVE-2018-9058 describes an infinite loop in runzip_fd in runzip.c in Long Range Zip, also known as lrzip, 0.631. The CVE states remote attackers could trigger denial of service using a crafted lrz file. No CVSS, CWE, patch version, or KEV exploitation evidence is provided in the bundle.
Likely exposure
Exposure is most likely where lrzip 0.631 is installed and used to decompress .lrz files from untrusted users, email, uploads, automation pipelines, malware sandboxes, or archival workflows.
Exploitation context
The sources support denial of service through a crafted .lrz file. They do not show active exploitation, public weaponization, affected downstream packages, or a confirmed fixed release.
Researcher notes
The public record is sparse: affected version is named in the CVE text, but structured affected product data is not useful. The root condition is an infinite loop in runzip_fd. Validate impact in a controlled, non-production setting without publishing crafted samples.
Mitigation direction
- Identify and reduce any automated processing of untrusted .lrz files.
- Check upstream lrzip guidance and distribution package advisories for fixed versions.
- Run archive extraction with timeouts, CPU limits, and process isolation.
- Block or quarantine unexpected .lrz attachments and uploads where business use is absent.
- Prefer manual review for externally supplied lrzip archives until remediated.
Validation and detection
- Inventory systems and containers for lrzip, especially version 0.631.
- Find services, scripts, or queues that call lrzip on external input.
- Confirm whether .lrz uploads, emails, or archives reach automated extraction paths.
- Review monitoring for stuck lrzip processes or repeated extraction timeouts.
- Verify package manager or upstream release notes before marking fixed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-9058 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ckolivas/lrzip/issues/93CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.