Every CVE Search/ Get API key

CVE-2026-105841

lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode

7.7 HighFix available

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.94%Unchanged since Oct 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.7

lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.

Record
CVE-2026-105841
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2026-93393 7.7

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.

Record
EUVD-2026-93393
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-w9c3-4vq7-c452 7.7

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's...

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.

Record
GHSA-w9c3-4vq7-c452
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
NVD 7.7

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.

Record
CVE-2026-105841
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVDEBIAN-CVE-2026-105841 7.5

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.

Record
DEBIAN-CVE-2026-105841
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:83525 7.5

Red Hat Security Advisory: lrzsz security, bug fix, and enhancement update

Record
RHSA-2026:83525
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVRLSA-2026:83525 7.5

Important: lrzsz security, bug fix, and enhancement update

Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.

Security Fix(es):

  • lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

  • lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

Bug Fix(es) and Enhancement(s):

  • lrzsz: segfault with -s [rhel-8.10.z] (JIRA:Rocky Linux-282148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:83525
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:86056 7.5

Important: lrzsz security, bug fix, and enhancement update

Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.

Security Fix(es):

  • lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

  • lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

Bug Fix(es) and Enhancement(s):

  • lrzsz: segfault with -s [rhel-10.2.z] (JIRA:Rocky Linux-282106)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:86056
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:89755 7.5

Important: lrzsz security, bug fix, and enhancement update

Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.

Security Fix(es):

  • lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

  • lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

Bug Fix(es) and Enhancement(s):

  • lrzsz: segfault with -s [rhel-9.8.z] (JIRA:Rocky Linux-282108)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:89755
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-105841 7.7

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.

Record
UBUNTU-CVE-2026-105841
CVSS 4.0
7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:83525 No score

Important: lrzsz security, bug fix, and enhancement update

Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.

Security Fix(es):

  • lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)
  • lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

Bug Fix(es) and Enhancement(s):

  • lrzsz: segfault with -s [almalinux-8.10.z] (JIRA:AlmaLinux-282148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:83525
Updated
2026-11-02
OSVALSA-2026:86056 No score

Important: lrzsz security, bug fix, and enhancement update

Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.

Security Fix(es):

  • lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)
  • lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

Bug Fix(es) and Enhancement(s):

  • lrzsz: segfault with -s [almalinux-10.2.z] (JIRA:AlmaLinux-282106)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86056
Updated
2026-11-02
OSVALSA-2026:89755 No score

Important: lrzsz security, bug fix, and enhancement update

Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.

Security Fix(es):

  • lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)
  • lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

Bug Fix(es) and Enhancement(s):

  • lrzsz: segfault with -s [almalinux-9.8.z] (JIRA:AlmaLinux-282108)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:89755
Updated
2026-11-02
OSVAZL-106673 No score

CVE-2026-105841 affecting package lrzsz 0.12.20-50

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.

Record
AZL-106673
Updated
2026-11-05
OSVCLSA-2026-1792053113 No score

lrzsz: Fix of 3 CVEs

  • CVE-2026-105840: lrz: reject absolute and escaping paths in restricted mode
  • CVE-2026-105841: lrz: remove piping received files to a shell command
  • CVE-2026-105842: lrz: terminate received data and bound file name length
Record
CLSA-2026-1792053113
Updated
2026-11-02
OSVCLSA-2026-1792422501 No score

Fix CVE(s): CVE-2026-105840, CVE-2026-105841, CVE-2026-105842

  • SECURITY UPDATE: absolute path names accepted in restricted mode
    • debian/patches/CVE-2026-105840.patch: reject absolute path names in restricted mode in checkpath() in src/lrz.c and wcs() in src/lsz.c, not only in PUBDIR builds
    • CVE-2026-105840
  • SECURITY UPDATE: command injection via the pipe mode
    • debian/patches/CVE-2026-105841.patch: remove the pipe mode that ran received files through a shell command when lrz was invoked as rzCOMMAND, in src/lrz.c
    • CVE-2026-105841
  • SECURITY UPDATE: heap buffer overflow via a long file name
    • debian/patches/CVE-2026-105842.patch: allocate the received path name with strdup() instead of a fixed PATH_MAX*2 buffer, and NUL-terminate the ZFILE subpacket, in src/lrz.c
    • CVE-2026-105842
Record
CLSA-2026-1792422501
Updated
2026-11-02
OSVCLSA-2026-1792503867 No score

lrzsz: Fix of 3 CVEs

  • CVE-2026-105840: reject absolute path names in restricted mode in lrz (received files) and lsz (sent files), not only in PUBDIR builds
  • CVE-2026-105841: remove the pipe mode that ran received files through a shell command when lrz was invoked as rzCOMMAND
  • CVE-2026-105842: allocate the received path name with strdup() instead of a fixed PATH_MAX*2 buffer, and NUL-terminate the ZFILE subpacket
Record
CLSA-2026-1792503867
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lrzsz
AlmaLinux:8
From an advisory covering 2 CVEs
 before 0.12.20-46.el8_10
0.12.20-46.el8_10
lrzsz
AlmaLinux:10
From an advisory covering 2 CVEs
 before 0.12.20-69.el10_2
0.12.20-69.el10_2
lrzsz
AlmaLinux:9
From an advisory covering 2 CVEs
 before 0.12.20-58.el9_8
0.12.20-58.el9_8
lrzsz
Azure Linux:3
 through 0.12.20-50 None known
lrzsz
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 0.12.20-55.el9.tuxcare.els1
0.12.20-55.el9.tuxcare.els1
lrzsz
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 0.12.21-10~build0.18.04.1+tuxcare.els1
0.12.21-10~build0.18.04.1+tuxcare.els1
lrzsz
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 0.12.20-55.el9_6.tuxcare.els1
0.12.20-55.el9_6.tuxcare.els1
lrzsz
Debian:12
 All versions, plus listed versions
0.12.21-100.12.21-110.12.21rc-0.10.12.21rc-0.20.12.21rc-0.3
Show 6 moreShow less
0.12.21rc-10.12.21rc-20.12.21rc-30.12.21rc-40.12.21rc-50.13.1-1
 None known
lrzsz
Debian:13
 All versions, plus listed versions
0.12.21rc-0.20.12.21rc-0.30.12.21rc-10.12.21rc-20.12.21rc-30.12.21rc-40.12.21rc-50.13.1-1
 None known
lrzsz
Debian:14
 before 0.13.1-1, plus listed versions
0.12.21rc-0.20.12.21rc-0.30.12.21rc-10.12.21rc-20.12.21rc-30.12.21rc-40.12.21rc-5
0.13.1-1
Show 14 moreShow less
Affected packages
PackageAffectedFixed
lrzsz
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:0.12.20-46.el8_10
0:0.12.20-46.el8_10
lrzsz-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:0.12.20-46.el8_10
0:0.12.20-46.el8_10
lrzsz-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 2 CVEs
 before 0:0.12.20-46.el8_10
0:0.12.20-46.el8_10
lrzsz
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:0.12.20-46.el8_10
0:0.12.20-46.el8_10
lrzsz
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:0.12.20-69.el10_2
0:0.12.20-69.el10_2
lrzsz
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:0.12.20-58.el9_8
0:0.12.20-58.el9_8
lrzsz
Ubuntu:14.04:LTS
 All versions, plus listed versions
0.12.21-50.12.21-70.12.21-10~build0.14.04.1
 None known
lrzsz
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.12.21-80.12.21-10~build0.16.04.1
 None known
lrzsz
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.12.21-80.12.21-8build10.12.21-10~build0.18.04.1
 None known
lrzsz
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.12.21-10
 None known
lrzsz
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.12.21-10
 None known
lrzsz
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.12.21-100.12.21-110.12.21-11build1
 None known
lrzsz
Ubuntu:26.10
 All versions, plus listed versions
0.12.21rc-0.30.12.21rc-10.12.21rc-20.12.21rc-4
 None known
lrzsz
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.12.21rc-0.20.12.21rc-0.3
 None known

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-105841 is a high vulnerability (CVSS 7.7) in Microsoft Lrzsz, published October 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 61st percentile. Fixed in lrzsz 0.13.1-1.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open