In Long Range Zip (aka lrzip) 0.631 there is a use-after-free in the lzma_decompress_buf function of stream.c which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.