GNU gzip EUVD-2026-40068

Two specific, non-default preconditions must both be satisfied: (1) the mktemp utility must be absent from the executing user's PATH - this is the trigger for the vulnerable PID-based fallback and does not occur on standard installations of Debian, Red Hat, Ubuntu, or other major Linux distributions where mktemp ships as part of GNU coreutils; (2) the attacker must win the TOCTOU race by successfully pre-placing a symlink at the predicted path before gzexe creates its temporary file - the CVSS 4.0 AT:P metric explicitly reflects this precondition. Additionally, the victim (UI:P) must actively invoke gzexe during the attack window. Exploitation is strictly local (AV:L); no remote vector exists. The maximum impact is overwriting files writable by the victim process, bounded by the victim's own filesystem permissions; no code execution or privilege escalation path is described.

The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) scores 2.0, accurately capturing the low real-world risk. AV:L confines exploitation to local system access; AC:H reflects the race condition timing requirement; AT:P explicitly encodes the non-default precondition that mktemp must be absent from PATH; and VI:L caps the worst-case outcome at file overwrite with no code execution, privilege escalation, or confidentiality breach. No EPSS score was provided in the source intelligence, so exploitation probability cannot be quantified independently. No KEV listing and no public POC exist, indicating no observed or confirmed in-the-wild exploitation. The 'Information Disclosure' tag assigned by the reporter (cvd@cert.pl) conflicts with the described impact, which is purely an integrity violation - this inconsistency is unresolved and may represent a tagging error. Overall, this is a genuine but low-priority vulnerability: the triggering condition (missing mktemp) is non-default on all major modern Linux distributions, the race window is narrow, and the maximum impact is limited file corruption rather than full system compromise.

A local attacker sharing a system with the victim monitors or predicts the PID that will be assigned to the victim's next gzexe invocation, then pre-creates a symlink at the predicted temporary file path - for example, pointing to the victim's crontab or a user-writable configuration file. When the victim runs gzexe on a system where mktemp is absent from PATH, gzexe resolves the symlink and overwrites the attacker-chosen target file with temporary data, corrupting it. No public proof-of-concept code has been identified at time of analysis.