EUVD-2026-40068
GHSA-67v8-88jf-4x6q
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local TOCTOU race with non-default mktemp-absent trigger sets AC:H; no code execution limits impact to I:L only.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
1DescriptionCVE.org
GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.
This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269
AnalysisAI
Arbitrary file overwrite in GNU gzip's gzexe utility allows a local attacker to corrupt victim-accessible files via a symlink attack exploiting predictable temporary filename construction. When mktemp is absent from the user's PATH, gzexe falls back to PID-based temp file naming without exclusive creation or existence checks, enabling a TOCTOU race where a pre-planted symlink redirects the write to an attacker-chosen target. No public exploit or CISA KEV listing exists at time of analysis; impact is limited to low-integrity file overwrite with a CVSS 4.0 score of 2.0.
Technical ContextAI
GNU gzip's gzexe utility is a shell script that compresses executable files and prepends a self-extracting stub. CWE-377 (Insecure Temporary File) describes the root cause: gzexe's fallback path, triggered when mktemp is absent from PATH, constructs temporary filenames from the process ID (PID). PID namespaces on Linux are typically bounded at 32768 or fewer values, making the filename predictable. The absence of O_EXCL-style exclusive file creation and pre-existence checks introduces a classic TOCTOU window between filename selection and file creation. The upstream fix is recorded in cgit commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 in the GNU gzip Savannah repository. No CPE string was supplied in the source intelligence; the affected component is the gzexe script bundled with GNU gzip as documented at https://www.gnu.org/software/gzip/.
RemediationAI
The upstream fix is available as commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 in the GNU gzip repository (https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269); upstream fix available via commit but a released patched version is not independently confirmed at time of analysis - monitor https://www.gnu.org/software/gzip/ and downstream distribution advisories for a tagged release. The most effective immediate compensating control is to ensure mktemp (part of GNU coreutils) is present in the PATH of any user who may invoke gzexe - this eliminates the vulnerable fallback entirely without side effects on other functionality. If gzexe is not operationally required, removing or restricting execute permissions on the gzexe binary is a low-risk mitigation. Environments where shared local access is a concern should apply filesystem-level controls limiting writable directories accessible to untrusted local users while awaiting a patched package from their distribution vendor.
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. Rated high severity (CVSS 8.8), this vulner
Out-of-bounds read in GNU gzip's LZH decompression logic allows an unprivileged local attacker to disclose memory conten
Same weakness CWE-377 – Insecure Temporary File
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today