Every CVE Search/ Get API key

CVE-2026-105842

lrzsz before 0.13.0 Heap Buffer Overflow via lrz procheader() Pathname

6.1 MediumFix available

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
High

Exploit likelihood

0.21%Unchanged since Oct 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

lrzsz before 0.13.0 Heap Buffer Overflow via lrz procheader() Pathname

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Record
CVE-2026-105842
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2026-93394 6.1

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Record
EUVD-2026-93394
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-3cw3-cf87-8pwp 6.1

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the...

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Record
GHSA-3cw3-cf87-8pwp
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-122
Updated
2026-11-02
NVD 6.1

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Record
CVE-2026-105842
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-122
Updated
2026-11-02
OSVDEBIAN-CVE-2026-105842 6.1

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Record
DEBIAN-CVE-2026-105842
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-105842 6.1

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Record
UBUNTU-CVE-2026-105842
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVAZL-106670 No score

CVE-2026-105842 affecting package lrzsz 0.12.20-50

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Record
AZL-106670
Updated
2026-11-05
OSVCLSA-2026-1792053113 No score

lrzsz: Fix of 3 CVEs

  • CVE-2026-105840: lrz: reject absolute and escaping paths in restricted mode
  • CVE-2026-105841: lrz: remove piping received files to a shell command
  • CVE-2026-105842: lrz: terminate received data and bound file name length
Record
CLSA-2026-1792053113
Updated
2026-11-02
OSVCLSA-2026-1792422501 No score

Fix CVE(s): CVE-2026-105840, CVE-2026-105841, CVE-2026-105842

  • SECURITY UPDATE: absolute path names accepted in restricted mode
    • debian/patches/CVE-2026-105840.patch: reject absolute path names in restricted mode in checkpath() in src/lrz.c and wcs() in src/lsz.c, not only in PUBDIR builds
    • CVE-2026-105840
  • SECURITY UPDATE: command injection via the pipe mode
    • debian/patches/CVE-2026-105841.patch: remove the pipe mode that ran received files through a shell command when lrz was invoked as rzCOMMAND, in src/lrz.c
    • CVE-2026-105841
  • SECURITY UPDATE: heap buffer overflow via a long file name
    • debian/patches/CVE-2026-105842.patch: allocate the received path name with strdup() instead of a fixed PATH_MAX*2 buffer, and NUL-terminate the ZFILE subpacket, in src/lrz.c
    • CVE-2026-105842
Record
CLSA-2026-1792422501
Updated
2026-11-02
OSVCLSA-2026-1792503867 No score

lrzsz: Fix of 3 CVEs

  • CVE-2026-105840: reject absolute path names in restricted mode in lrz (received files) and lsz (sent files), not only in PUBDIR builds
  • CVE-2026-105841: remove the pipe mode that ran received files through a shell command when lrz was invoked as rzCOMMAND
  • CVE-2026-105842: allocate the received path name with strdup() instead of a fixed PATH_MAX*2 buffer, and NUL-terminate the ZFILE subpacket
Record
CLSA-2026-1792503867
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lrzsz
Azure Linux:3
 through 0.12.20-50 None known
lrzsz
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 0.12.20-55.el9.tuxcare.els1
0.12.20-55.el9.tuxcare.els1
lrzsz
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 0.12.21-10~build0.18.04.1+tuxcare.els1
0.12.21-10~build0.18.04.1+tuxcare.els1
lrzsz
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 0.12.20-55.el9_6.tuxcare.els1
0.12.20-55.el9_6.tuxcare.els1
lrzsz
Debian:12
 All versions, plus listed versions
0.12.21-100.12.21-110.12.21rc-0.10.12.21rc-0.20.12.21rc-0.3
Show 6 moreShow less
0.12.21rc-10.12.21rc-20.12.21rc-30.12.21rc-40.12.21rc-50.13.1-1
 None known
lrzsz
Debian:13
 All versions, plus listed versions
0.12.21rc-0.20.12.21rc-0.30.12.21rc-10.12.21rc-20.12.21rc-30.12.21rc-40.12.21rc-50.13.1-1
 None known
lrzsz
Debian:14
 before 0.12.21rc-5, plus listed versions
0.12.21rc-0.20.12.21rc-0.30.12.21rc-10.12.21rc-20.12.21rc-30.12.21rc-4
0.12.21rc-5
lrzsz
Ubuntu:14.04:LTS
 All versions, plus listed versions
0.12.21-50.12.21-70.12.21-10~build0.14.04.1
 None known
lrzsz
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.12.21-80.12.21-10~build0.16.04.1
 None known
lrzsz
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.12.21-80.12.21-8build10.12.21-10~build0.18.04.1
 None known
Show 5 moreShow less
Affected packages
PackageAffectedFixed
lrzsz
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.12.21-10
 None known
lrzsz
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.12.21-10
 None known
lrzsz
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.12.21-100.12.21-110.12.21-11build1
 None known
lrzsz
Ubuntu:26.10
 All versions, plus listed versions
0.12.21rc-0.30.12.21rc-10.12.21rc-20.12.21rc-4
 None known
lrzsz
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.12.21rc-0.20.12.21rc-0.3
 None known

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-105842 is a medium vulnerability (CVSS 6.1) in Microsoft Lrzsz, published October 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in lrzsz 0.12.21rc-5.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open