lrzsz EUVD-2026-93392

Exploitation requires three concrete conditions, not raw network reach: (1) the victim must actively run the lrz receive utility in its restricted mode and initiate/accept a ZMODEM transfer (UI:P / AT:P), (2) the binary must be built WITHOUT the --enable-pubdir option (the default), since only that build hardens checkpath(), and (3) the attacker must control the sending side of the ZMODEM session. The write primitive is further LIMITED to files that the receiving user account can already write - it does not by itself grant privilege escalation beyond that user, though overwriting that user's SSH keys, shell profiles, or cron files can extend impact. These user-interaction and restricted-mode prerequisites meaningfully reduce real-world exploitability below what the unauthenticated network vector alone suggests.

This is a genuine but conditional integrity/availability risk rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P) scores 7.7 (HIGH): network-reachable and unauthenticated (PR:N), but it carries both an attack requirement (AT:P) and passive user interaction (UI:P), meaning the victim must actually invoke lrz to receive a file from an attacker-controlled ZMODEM sender, and the receiver must be running in restricted mode built without --enable-pubdir. No EPSS score, SSVC decision, KEV entry, or POC was provided in the input - exploitation status is therefore 'no public exploit identified at time of analysis.' The absence of KEV/EPSS data means real-world exploitation frequency cannot be quantified from the provided sources. One signal to reconcile: the input vector rates confidentiality impact as VC:H, but the description describes only a file-WRITE/overwrite primitive ('write files outside the current directory', 'overwrite any file writable by the receiving user'), which is primarily an integrity and availability issue - confidentiality impact appears to be an indirect consequence (e.g., overwriting authorized_keys or shell profiles to pivot) rather than a direct data-disclosure capability; verify with vendor. Net: a real, patchable flaw worth remediating where lrzsz is used for untrusted serial/network transfers, but not a drop-everything internet-wide threat given the user-interaction and restricted-mode preconditions.

A user runs lrz in restricted mode to receive files over a ZMODEM session (e.g., a serial console, terminal, or networked transfer) from a host they do not fully control. The malicious sender transmits a file whose name is an absolute path such as /home/victim/.ssh/authorized_keys; because checkpath() in src/lrz.c only blocks '../' sequences (and only when built with --enable-pubdir), the absolute path is accepted and the attacker overwrites any file the receiving user can write. No public POC was identified in the provided data.