lrzsz CVE-2026-105841

Exploitation requires lrz to be invoked under a suffixed/alias name such as lrztar operating in pipe mode - procheader() only passes the filename to popen() in that mode, so a default plain-lrz invocation is not affected. The attacker must control the sending side of the ZMODEM/YMODEM transfer and supply a crafted filename containing shell metacharacters, and the victim must actively initiate or accept the transfer (UI:P). Limiting factors: the non-default lrztar/pipe invocation requirement (AT:P), the required victim interaction, and that injected commands run only with the privileges of the receiving user (SC:N/SI:N/SA:N - no built-in privilege escalation or impact on other systems).

The vendor-supplied CVSS 4.0 score is 7.7 (High), driven by a network vector (AV:N), low attack complexity (AC:L), and full compromise of the vulnerable system (VC:H/VI:H/VA:H) via arbitrary command execution. However, three metrics materially temper real-world risk: AT:P indicates a specific attack requirement must hold (lrz must be invoked under a suffixed alias such as lrztar in pipe mode - a non-default configuration), UI:P requires the victim to initiate/accept the ZMODEM/YMODEM transfer, and SC:N/SI:N/SA:N confirm no scope change - code runs only as the receiving user with no inherent privilege escalation. No EPSS probability, CISA KEV listing, or POC indicator is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a genuine remote code-execution flaw but its practical exploitability is gated by social engineering (victim must receive an attacker-named file) and a non-default invocation name, making it a moderate-priority patch rather than a drop-everything emergency. PR:N (unauthenticated) is confirmed by the CVSS 4.0 vector.

An attacker who controls the sending end of a ZMODEM/YMODEM session - for example a malicious or compromised remote host the victim connects to - offers a file whose name embeds shell metacharacters. When the victim receives it using lrz invoked under a suffixed name such as lrztar (pipe mode), procheader() in src/lrz.c passes the unescaped filename to popen() and the embedded command executes as the receiving user. No public exploit identified at time of analysis; exploitation requires the victim to initiate the transfer (UI:P).