Skip to main content

GNU gzip CVE-2026-41992

| EUVDEUVD-2026-40069 MEDIUM
Buffer Over-read (CWE-126)
2026-06-29 cvd@cert.pl GHSA-qxh4-rprf-2mmj
Buffer Overflow Gzip Red Hat
6.9
CVSS 4.0 · Vendor: cert
Share

Severity by source

Vendor (cert) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.2 MEDIUM

Local vector because attacker must supply controlled files to the gzip process; no privileges needed per PR:N; only confidentiality impacted via out-of-bounds read with no write or availability consequence.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Red Hat
3.6 LOW
qualitative

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 29, 2026 - 12:34 vuln.today

DescriptionCVE.org

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.

This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681

AnalysisAI

Out-of-bounds read in GNU gzip's LZH decompression logic allows an unprivileged local attacker to disclose memory contents by supplying two specially crafted archives - an LZW file followed by an LZH file - in a single gzip -d invocation. The shared global decompression array, never reinitialized between files in the same process invocation, is poisoned by the LZW pass and subsequently causes the LZH decoder to read past the end of the allocated buffer, yielding high confidentiality impact per the CVSS 4.0 vector (VC:H). No public exploit or CISA KEV listing has been identified at time of analysis; the fix exists as an upstream source commit only, with no confirmed packaged release.

Technical ContextAI

GNU gzip, the foundational GNU compression utility ubiquitous across Unix and Linux environments, implements multiple legacy decompression algorithms including LZ77, LZW (Unix compress format), and LZH. The vulnerability arises from a design flaw where a global array is shared across all three decompression routines without being reinitialized between files processed in the same gzip process invocation. CWE-126 (Buffer Over-read) precisely classifies the root cause: the LZH decoder does not validate the contents of the shared global array before use, blindly following stale pointer or index values written during a prior LZW decompression pass, which causes reads to exceed the boundary of the allocated global buffer. The flaw is specific to multi-file batch decompression within a single invocation and is not triggered by processing a single file.

RemediationAI

Apply the upstream fix at commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681 in the GNU gzip cgit repository (https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681). This is a source-level commit; a versioned packaged release incorporating this fix has not been independently confirmed from the available references - monitor the GNU gzip project page at https://www.gnu.org/software/gzip/ and downstream distribution security channels (Debian DSA, Red Hat RHSA, Ubuntu USN, Alpine secdb) for official patched packages. As a compensating control where patching is not immediately feasible, restrict gzip-based decompression pipelines from accepting untrusted LZW or LZH format inputs alongside each other in batch; processing files in separate single-file gzip invocations (rather than multi-file batch invocations) eliminates the cross-format state pollution pathway. This workaround carries the operational trade-off of increased subprocess overhead and does not fix the underlying flaw.

More in Gzip

View all
CVE-2022-1271 HIGH
8.8 Aug 31

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. Rated high severity (CVSS 8.8), this vulner
CVE-2026-41991 LOW
2.0 Jun 29

Arbitrary file overwrite in GNU gzip's gzexe utility allows a local attacker to corrupt victim-accessible files via a sy

Same weakness CWE-126 – Buffer Over-read

View all
CVE-2017-7668 HIGH
7.5
CVE-2017-7679 CRITICAL POC
9.8
CVE-2021-34584 CRITICAL POC
9.1
CVE-2022-1987 HIGH POC
8.1
CVE-2022-1908 HIGH POC
8.1
CVE-2022-1907 HIGH POC
8.1
CVE-2026-64905 HIGH
7.8
CVE-2023-0817 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-41992 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy