Do Son 
- Product: GNU gzip
- Vulnerabilities: 2 flaws (CVE-2026-41991, CVE-2026-41992)
- Highest severity: 6.9 (Medium · CVSSv4)
- Worst impact: Global Buffer Overflow in
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv4) | Type | Status |
|---|---|---|---|
| CVE-2026-41992 | 6.9 | Global Buffer Overflow in | Not exploited |
| CVE-2026-41991 | 2 | Predictable Temporary File in | Not exploited |
TL;DR
CERT Polska disclosed two flaws in GNU gzip on 29 June 2026. One GNU gzip vulnerability, CVE-2026-41991, lets a local attacker overwrite files. The second, CVE-2026-41992, triggers an out-of-bounds read. Both bugs affect every gzip release through version 1.14.
Why It Matters
gzip ships on nearly every Linux and Unix system. So this GNU gzip vulnerability reaches a very large install base. The file-overwrite bug can also chain toward privilege escalation. As a result, administrators should patch without delay.
How the Attack Works
CVE-2026-41991: gzexe symlink attack
The first flaw sits in the gzexe helper script. When mktemp is missing from PATH, gzexe builds a temporary filename from the process ID alone. That name is predictable, and the script skips existence checks. So a local user can plant a symlink at that path in advance. gzexe then follows the link and overwrites the target file. This race creates a classic time-of-check to time-of-use condition.
CVE-2026-41992: poisoned LZH state
The second flaw lives in the LZH decompression code. gzip reuses one global array across LZ77, LZW, and LZH routines without resetting it. A crafted LZW file followed by an LZH file in a single command poisons that state. Consequently, the LZH decoder reads past the buffer.
Affected Versions
Both issues affect all GNU gzip versions through 1.14. No public exploit or in-the-wild abuse has been confirmed.
Patch and Mitigation
The maintainers fixed both bugs in upstream commits. Therefore, update to a patched gzip build from your distribution. CERT Polska coordinated the disclosure and credited AFINE researchers Michal Majchrowicz and Marcin Wyczechowski.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
