lrzsz EUVD-2026-93394

Exploitation requires the victim to actively run the lrz receive utility and accept an inbound ZMODEM transfer from an attacker-controlled or compromised sender (UI:P / AT:P) - it cannot be triggered passively. The attacker must supply a filename approaching 8192 bytes to overflow the fixed Pathname buffer; the sprintf() path is specifically reached when lrz operates in pipe mode, while the strcpy() path applies more generally. Affected builds are lrzsz before 0.13.0 (vendor uwe_ohse). Limiting factors: no code path is reached unless a receive session is initiated, exposure is bounded to hosts that actually use lrz for ZMODEM transfers, and the primary demonstrated impact is a crash (denial of service) rather than confirmed remote code execution.

This is a moderate-severity memory-safety flaw whose real-world risk is limited by its exploitation preconditions rather than its reachability. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, base 6.1) shows no privileges required (PR:N) but both a present attack requirement (AT:P) and active user interaction (UI:P) - the victim must voluntarily initiate a ZMODEM receive via lrz from an attacker-controlled sender, which is the dominant risk-limiting factor. Impact is skewed toward availability (VA:H) with only low confidentiality/integrity impact (VC:L/VI:L), consistent with a description that characterizes the outcome as heap corruption and a crash rather than confirmed arbitrary code execution. No EPSS score, KEV listing, or POC indicator is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a legitimate bug worth patching on systems that use lrz, but not an urgent fleet-wide priority - the required user-initiated transfer from a malicious peer makes it a targeted/opportunistic concern rather than a wormable or mass-exploitable one. Note a mild tension to verify with the vendor: the description mentions sprintf()/strcpy() heap overflow that 'could corrupt heap memory,' which in principle can escalate beyond a crash, yet the CVSS impact is scored only VA:H with low C/I - treat code-execution potential as unconfirmed.

An attacker who controls or compromises the remote end of a serial/terminal session waits for (or socially engineers) a victim to start a ZMODEM download using lrz, then transmits a file whose name is up to 8192 bytes long. When procheader() copies this oversized sender-supplied filename into the fixed Pathname buffer via sprintf() (pipe mode) or strcpy(), the heap buffer overflows, corrupting memory and crashing lrz. No public exploit code is identified in the supplied data.