GNU gzip flaws allow file overwrite and buffer overflow

Two vulnerabilities in GNU gzip — CVE-2026-41991 (insecure temp file handling in gzexe) and CVE-2026-41992 (buffer overflow in LZH decompression) — enable local file overwrite and memory corruption.

CERT Polska disclosed two vulnerabilities in GNU gzip affecting the widely deployed compression utility. CVE-2026-41991 is a time-of-check to time-of-use (TOCTOU) race condition in the gzexe utility that occurs when the mktemp utility is unavailable. The utility falls back to creating temporary files with predictable PID-based names without existence checks, allowing a local attacker to pre-create a symlink pointing to an arbitrary writable file. When gzexe executes, it follows the symlink and overwrites the target, enabling arbitrary file overwrite by a local user.

CVE-2026-41992 is a global buffer overflow in the LZH decompression logic caused by improper reuse of shared global state between different compression formats (LZ77, LZW, LZH). A shared global array is not reinitialized between files in a single invocation. An attacker can craft a malicious LZW file followed by a malicious LZH file and decompress them with a single gzip -d command to poison the shared state, triggering an out-of-bounds read when the LZH decoder follows stale values in the array. Both issues have been patched in the GNU gzip repository.

The vulnerabilities were reported by researchers Michal Majchrowicz and Marcin Wyczechowski from AFINE through CERT Polska's coordinated vulnerability disclosure process. Organizations using GNU gzip should apply the available patches promptly, particularly in environments where untrusted users have local access or where automated decompression of untrusted archives occurs.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-41991/