# GNU gzip patches two local vulnerabilities

Published: 2026-06-29 · Severity: low
Canonical: https://vorant.io/reports/09922f7f-9164-5f23-8f31-7d6153868cc5/gnu-gzip-patches-two-local-vulnerabilities

> GNU gzip fixed a symlink-based file overwrite bug in gzexe and a global buffer overflow in LZH decompression logic.

CERT Polska coordinated disclosure of two vulnerabilities in GNU gzip, reported by researchers Michal Majchrowicz and Marcin Wyczechowski of AFINE. CVE-2026-41991 affects the gzexe utility, which falls back to a predictable PID-based temporary file path when mktemp is unavailable in PATH. Because the file is created without exclusive access or existence checks, a local attacker can pre-create a symlink at the predicted path pointing to an arbitrary file the victim can write to, resulting in a TOCTOU condition that allows arbitrary file overwrite.

CVE-2026-41992 is a global buffer overflow in gzip's LZH decompression logic, caused by shared global state being reused across LZ77, LZW, and LZH decompression routines without reinitialization between files in a single invocation. By crafting a malicious LZW file followed by a crafted LZH file processed in the same gzip -d command, an attacker can poison shared state and trigger an out-of-bounds read in the LZH decoder.

Both issues have been patched upstream via dedicated commits. These are local-exploitation vulnerabilities requiring specific conditions (missing mktemp in PATH, or crafted multi-file decompression sequences) and there is no indication of active exploitation in the wild. Severity is limited given the local attack vector and lack of known exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-41991, CVE-2026-41992

## Detection guidance (public sample)

### Symlink Pre-Staged at Predictable gzexe Temporary File Path

ATT&CK: T1068

Detects creation of a symbolic link under /tmp whose name follows the PID-based pattern used by gzexe's fallback temp-file logic when mktemp is unavailable, a precursor to the TOCTOU arbitrary-file-overwrite technique (CVE-2026-41991). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Symlink Pre-Staged at Predictable gzexe Temporary File Path
description: Detects the creation of a symbolic link in /tmp with a name matching
  the predictable PID-based fallback pattern used by gzexe when mktemp is not available
  in PATH. Attackers can pre-create such a symlink pointing to an attacker-writable-but-victim-owned
  target so that gzexe's non-exclusive temp-file write results in an arbitrary file
  overwrite (TOCTOU, CVE-2026-41991). Generalises on the naming convention and symlink-before-write
  behaviour rather than a specific victim path.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: /tmp/gz
    TargetFilename|re: .*[0-9]{2,7}$
  filter_mktemp_pattern:
    TargetFilename|contains: XXXXXX
  condition: selection and not filter_mktemp_pattern
falsepositives:
- Legitimate gzip/gzexe temp files created via mktemp (which use random XXXXXX suffixes,
  not raw PID digits)
- Custom build/CI scripts that create numerically-suffixed temp files under /tmp unrelated
  to gzexe
level: medium
id: ea799857-14f7-5d92-ad38-edf7b405197f
status: experimental
author: Vorant
```

### GNU gzip Decompressing Multiple Files in a Single Invocation

ATT&CK: T1068

Flags a single gzip -d invocation processing multiple input files, the pre-condition needed to trigger the cross-format shared-state buffer overflow between LZW and LZH decompression (CVE-2026-41992). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: GNU gzip Decompressing Multiple Files in a Single Invocation
description: Detects gzip being invoked with the decompress flag against more than
  one input file in a single command line. This is the specific pre-condition required
  to exploit CVE-2026-41992, where shared global state between LZ77/LZW/LZH decompression
  routines is not reinitialised between files, allowing a crafted LZW file followed
  by a crafted LZH file in the same invocation to trigger an out-of-bounds read. Generalises
  on the multi-file decompress invocation pattern rather than any specific filenames.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /gzip
    CommandLine|contains:
    - -d
    - --decompress
  multi_file:
    CommandLine|re: (?:\s+\S+\.(?:gz|z|Z|lzh|lz)\b.*){2,}
  condition: selection and multi_file
falsepositives:
- Batch decompression scripts that legitimately pass several archive files to a single
  gzip -d command
- Package management or backup tooling invoking gzip with wildcard-expanded file lists
level: low
id: 19a57bc1-cb1b-5f87-a761-d9baf299dc4d
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-41991

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/09922f7f-9164-5f23-8f31-7d6153868cc5/gnu-gzip-patches-two-local-vulnerabilities.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup