{"id":"CVE-2026-105842","aliases":["AZL-106670","CLSA-2026-1792053113","CLSA-2026-1792422501","CLSA-2026-1792503867","DEBIAN-CVE-2026-105842","EUVD-2026-93394","GHSA-3cw3-cf87-8pwp","UBUNTU-CVE-2026-105842"],"status":"published","title":"lrzsz before 0.13.0 Heap Buffer Overflow via lrz procheader() Pathname","description":"lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.","severity":{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00206,"percentile":0.10791,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-10-06T13:35:47Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:14","package":"lrzsz","fixed_in":["0.12.21rc-5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.12.20-50"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.20-55.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21-10~build0.18.04.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.20-55.el9_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-10","0.12.21-11","0.12.21rc-0.1","0.12.21rc-0.2","0.12.21rc-0.3","0.12.21rc-1","0.12.21rc-2","0.12.21rc-3","0.12.21rc-4","0.12.21rc-5","0.13.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21rc-0.2","0.12.21rc-0.3","0.12.21rc-1","0.12.21rc-2","0.12.21rc-3","0.12.21rc-4","0.12.21rc-5","0.13.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21rc-5"}]}],"versions":["0.12.21rc-0.2","0.12.21rc-0.3","0.12.21rc-1","0.12.21rc-2","0.12.21rc-3","0.12.21rc-4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-5","0.12.21-7","0.12.21-10~build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-8","0.12.21-10~build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-8","0.12.21-8build1","0.12.21-10~build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-10"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-10","0.12.21-11","0.12.21-11build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21rc-0.3","0.12.21rc-1","0.12.21rc-2","0.12.21rc-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21rc-0.2","0.12.21rc-0.3"]}],"products":[{"vendor":"microsoft","product":"lrzsz"},{"vendor":"uwe ohse","product":"lrzsz"}],"references":[{"url":"https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html","tags":["vendor-advisory","report"]},{"url":"https://ohse.de/uwe/software/lrzsz.html","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-heap-buffer-overflow-via-lrz-procheader-pathname","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105842","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-3cw3-cf87-8pwp"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792053113.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105841","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1792422501.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792503867.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-105842","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-105842","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105842","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-105842","title":"lrzsz before 0.13.0 Heap Buffer Overflow via lrz procheader() Pathname","description":"lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.","status":"published","published":"2026-10-06T13:35:47.55Z","modified":"2026-10-06T19:30:50.71Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-93394","description":"lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.","status":"published","published":"2026-10-06T13:35:47Z","modified":"2026-10-06T19:30:50Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:36.701921Z"}],"ghsa":[{"id":"GHSA-3cw3-cf87-8pwp","title":"lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the...","description":"lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.","status":"published","published":"2026-10-06T15:31:59Z","modified":"2026-10-06T15:32:06Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:12:51.459076Z"}],"nvd":[{"id":"CVE-2026-105842","description":"lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.","status":"published","published":"2026-10-06T14:17:41.62Z","modified":"2026-10-06T20:17:16.72Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:54.486849Z"}],"osv":[{"id":"DEBIAN-CVE-2026-105842","description":"lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.","status":"published","published":"2026-10-06T14:17:41.62Z","modified":"2026-10-13T08:00:06.635062054Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:48.903138Z"},{"id":"UBUNTU-CVE-2026-105842","description":"lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.","status":"published","published":"2026-10-06T14:17:00Z","modified":"2026-10-17T12:58:00.162715918Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"},{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"AZL-106670","title":"CVE-2026-105842 affecting package lrzsz 0.12.20-50","description":"lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.","status":"published","published":"2026-10-06T14:17:41Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"CLSA-2026-1792053113","title":"lrzsz: Fix of 3 CVEs","description":"- CVE-2026-105840: lrz: reject absolute and escaping paths in restricted mode\n- CVE-2026-105841: lrz: remove piping received files to a shell command\n- CVE-2026-105842: lrz: terminate received data and bound file name length","status":"published","published":"2026-10-15T08:32:03Z","modified":"2026-10-26T09:30:39.105423301Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792422501","title":"Fix CVE(s): CVE-2026-105840, CVE-2026-105841, CVE-2026-105842","description":"   * SECURITY UPDATE: absolute path names accepted in restricted mode\n     - debian/patches/CVE-2026-105840.patch: reject absolute path names in\n       restricted mode in checkpath() in src/lrz.c and wcs() in src/lsz.c,\n       not only in PUBDIR builds\n     - CVE-2026-105840\n   * SECURITY UPDATE: command injection via the pipe mode\n     - debian/patches/CVE-2026-105841.patch: remove the pipe mode that ran\n       received files through a shell command when lrz was invoked as\n       rzCOMMAND, in src/lrz.c\n     - CVE-2026-105841\n   * SECURITY UPDATE: heap buffer overflow via a long file name\n     - debian/patches/CVE-2026-105842.patch: allocate the received path name\n       with strdup() instead of a fixed PATH_MAX*2 buffer, and NUL-terminate\n       the ZFILE subpacket, in src/lrz.c\n     - CVE-2026-105842","status":"published","published":"2026-10-19T15:08:34Z","modified":"2026-10-26T09:32:04.524825449Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792503867","title":"lrzsz: Fix of 3 CVEs","description":"- CVE-2026-105840: reject absolute path names in restricted mode in lrz\n  (received files) and lsz (sent files), not only in PUBDIR builds\n- CVE-2026-105841: remove the pipe mode that ran received files through a\n  shell command when lrz was invoked as rzCOMMAND\n- CVE-2026-105842: allocate the received path name with strdup() instead of\n  a fixed PATH_MAX*2 buffer, and NUL-terminate the ZFILE subpacket","status":"published","published":"2026-10-20T13:44:39Z","modified":"2026-10-26T09:31:19.959426553Z","updated_at":"2026-11-02T15:43:54.378946Z"}]}}