Skip to main content

GNU gzip CVE-2026-41991

| EUVDEUVD-2026-40068 LOW
Insecure Temporary File (CWE-377)
2026-06-29 cvd@cert.pl GHSA-67v8-88jf-4x6q
Information Disclosure Gzip
2.0
CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY
2.0 LOW
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
2.5 LOW

Local TOCTOU race with non-default mktemp-absent trigger sets AC:H; no code execution limits impact to I:L only.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
4.0 AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 29, 2026 - 12:33 vuln.today

DescriptionCVE.org

GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.

This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269

AnalysisAI

Arbitrary file overwrite in GNU gzip's gzexe utility allows a local attacker to corrupt victim-accessible files via a symlink attack exploiting predictable temporary filename construction. When mktemp is absent from the user's PATH, gzexe falls back to PID-based temp file naming without exclusive creation or existence checks, enabling a TOCTOU race where a pre-planted symlink redirects the write to an attacker-chosen target. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify system lacking mktemp in user PATH
Delivery
Predict victim gzexe process PID
Exploit
Pre-create symlink at predicted temp path
Execution
Victim invokes gzexe
Persist
gzexe follows symlink without existence check
Impact
Target file overwritten with temp data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two specific, non-default preconditions must both be satisfied: (1) the mktemp utility must be absent from the executing user's PATH - this is the trigger for the vulnerable PID-based fallback and does not occur on standard installations of Debian, Red Hat, Ubuntu, or other major Linux distributions where mktemp ships as part of GNU coreutils; (2) the attacker must win the TOCTOU race by successfully pre-placing a symlink at the predicted path before gzexe creates its temporary file - the CVSS 4.0 AT:P metric explicitly reflects this precondition. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) scores 2.0, accurately capturing the low real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A local attacker sharing a system with the victim monitors or predicts the PID that will be assigned to the victim's next gzexe invocation, then pre-creates a symlink at the predicted temporary file path - for example, pointing to the victim's crontab or a user-writable configuration file. When the victim runs gzexe on a system where mktemp is absent from PATH, gzexe resolves the symlink and overwrites the attacker-chosen target file with temporary data, corrupting it. …
Remediation The upstream fix is available as commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 in the GNU gzip repository (https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269); upstream fix available via commit but a released patched version is not independently confirmed at time of analysis - monitor https://www.gnu.org/software/gzip/ and downstream distribution advisories for a tagged release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Gzip

View all
CVE-2026-41992 MEDIUM
6.9 Jun 29

Out-of-bounds read in GNU gzip's LZH decompression logic allows an unprivileged local attacker to disclose memory conten

Same weakness CWE-377 – Insecure Temporary File

View all
CVE-2026-49134 HIGH
7.5
CVE-2026-20649 HIGH
7.5
CVE-2025-67223 HIGH
7.5
CVE-2026-49135 HIGH
7.2
CVE-2026-20204 HIGH
7.1
CVE-2026-40973 HIGH
7.0
CVE-2025-14614 MEDIUM
6.7
CVE-2025-14612 MEDIUM
6.7

Same technique Information Disclosure

View all
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2014-6324 HIGH POC
8.8
CVE-2017-0213 HIGH POC
7.3
CVE-2016-7255 HIGH POC
7.8
CVE-2010-0232 HIGH POC
7.8
CVE-2025-30066 HIGH POC
8.6
CVE-2025-54236 CRITICAL POC
9.1

Share

CVE-2026-41991 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy