{"id":"CVE-2026-41991","aliases":["ALPINE-CVE-2026-41991","ALSA-2026:61623","ALSA-2026:61625","ALSA-2026:65998","BELL-CVE-2026-41991","CLSA-2026-1783514299","CLSA-2026-1783934943","DEBIAN-CVE-2026-41991","EUVD-2026-40068","GHSA-67v8-88jf-4x6q","JLSEC-2026-1264","MGASA-2026-0245","OESA-2026-2969","OESA-2026-2970","OESA-2026-2971","OESA-2026-2972","OESA-2026-2997","RHSA-2026:33771","RHSA-2026:61623","RHSA-2026:61625","RHSA-2026:65998","RHSA-2026:79717","RLSA-2026:61623","RLSA-2026:61625","RLSA-2026:65998","ROOT-OS-DEBIAN-11-CVE-2026-41991","ROOT-OS-DEBIAN-12-CVE-2026-41991","ROOT-OS-DEBIAN-13-CVE-2026-41991","SUSE-SU-2026:22753-1","SUSE-SU-2026:22818-1","SUSE-SU-2026:22906-1","SUSE-SU-2026:22918-1","SUSE-SU-2026:3241-1","SUSE-SU-2026:3269-1","UBUNTU-CVE-2026-41991","USN-8512-1","USN-8733-1","USN-8733-2","openSUSE-SU-2026:11174-1","openSUSE-SU-2026:21371-1"],"status":"published","title":"Predictable Temporary File in GNU gzip","description":"GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269","severity":{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00117,"percentile":0.01679,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-377"],"published":"2026-06-29T10:15:50Z","modified":"2026-11-10T07:15:04Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"gzip","fixed_in":["1.15-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"gzip","fixed_in":["1.15-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gzip","fixed_in":["1.12-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gzip","fixed_in":["1.12-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gzip","fixed_in":["1.13-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gzip","fixed_in":["1.14-1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gzip","fixed_in":["0:1.14-2.2.hum1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"gzip","fixed_in":["1.10-4+deb11u1.aikido.2","1.10-4+deb11u1.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-gzip","fixed_in":["1.10-4+deb11u1.aikido.2","1.10-4+deb11u1.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"gzip","fixed_in":["1.12-1.aikido.2","1.12-1.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-gzip","fixed_in":["1.12-1.aikido.2","1.12-1.aikido.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"gzip","fixed_in":["1.13-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gzip","fixed_in":["1.13-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gzip","fixed_in":["1.13-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"gzip","fixed_in":["1.13-slfo.1.1_3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"gzip","fixed_in":["1.13-2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gzip","fixed_in":["1.10-4.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gzip","fixed_in":["1.10-4.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"gzip","fixed_in":["1.10-150200.13.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gzip","fixed_in":["1.6-3ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gzip","fixed_in":["1.6-4ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gzip","fixed_in":["1.6-5ubuntu1.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gzip","fixed_in":["1.10-0ubuntu4.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gzip","fixed_in":["1.10-4ubuntu4.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gzip","fixed_in":["1.12-1ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"gzip","fixed_in":["1.14-1~exp2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gzip","fixed_in":["1.14-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gzip","fixed_in":["1.13-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-15.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Alpaquita:stream","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12-r2"},{"fixed":"1.15-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12-1","1.12-1.1","1.12-1.2","1.13-1","1.13.56~e549-1~exp1","1.14-1","1.14-1~exp1","1.14-1~exp2"]},{"source":"osv","ecosystem":"Debian:13","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-1+deb13u1"}]}],"versions":["1.13-1"]},{"source":"osv","ecosystem":"Debian:14","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1"}]}],"versions":["1.13-1","1.13.56~e549-1~exp1","1.14-1~exp1","1.14-1~exp2"]},{"source":"osv","ecosystem":"Julia","package":"Gzip_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-2.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-7.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-3.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-7.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-7.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-2.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"gzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"gzip-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gzip-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9-15.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9-15.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gzip-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9-15.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15-1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9-15.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:11","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4+deb11u1.aikido.2"},{"fixed":"1.10-4+deb11u1.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4+deb11u1.aikido.2"},{"fixed":"1.10-4+deb11u1.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.aikido.2"},{"fixed":"1.12-1.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.aikido.2"},{"fixed":"1.12-1.aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-slfo.1.1_3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.13.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-3ubuntu1+esm2"}]}],"versions":["1.6-2ubuntu1","1.6-3ubuntu1","1.6-3ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-4ubuntu1+esm2"}]}],"versions":["1.6-4ubuntu1","1.6-4ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-5ubuntu1.2+esm1"}]}],"versions":["1.6-5ubuntu1","1.6-5ubuntu1.1","1.6-5ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-0ubuntu4.1+esm1"}]}],"versions":["1.10-0ubuntu3","1.10-0ubuntu4","1.10-0ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4ubuntu4.2"}]}],"versions":["1.10-4ubuntu1","1.10-4ubuntu2","1.10-4ubuntu3","1.10-4ubuntu4","1.10-4ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1ubuntu3.2"}]}],"versions":["1.12-1ubuntu1","1.12-1ubuntu2","1.12-1ubuntu3","1.12-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13-1ubuntu3","1.13-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1~exp2ubuntu1.1"}]}],"versions":["1.13-1ubuntu4","1.13-1ubuntu5","1.14-1~exp2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4ubuntu4.2"}]}],"versions":["1.10-4ubuntu1","1.10-4ubuntu2","1.10-4ubuntu3","1.10-4ubuntu4","1.10-4ubuntu4.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1ubuntu3.2"}]}],"versions":["1.12-1ubuntu1","1.12-1ubuntu2","1.12-1ubuntu3","1.12-1ubuntu3.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1~exp2ubuntu1.1"}]}],"versions":["1.13-1ubuntu4","1.13-1ubuntu5","1.14-1~exp2ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-4ubuntu1+esm2"}]}],"versions":["1.6-4ubuntu1","1.6-4ubuntu1+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-3ubuntu1+esm2"}]}],"versions":["1.6-2ubuntu1","1.6-3ubuntu1","1.6-3ubuntu1+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-5ubuntu1.2+esm1"}]}],"versions":["1.6-5ubuntu1","1.6-5ubuntu1.1","1.6-5ubuntu1.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-0ubuntu4.1+esm1"}]}],"versions":["1.10-0ubuntu3","1.10-0ubuntu4","1.10-0ubuntu4.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-160000.3.1"}]}]}],"products":[{"vendor":"gnu","product":"gzip"},{"vendor":"open source","product":"gzip"}],"references":[{"url":"https://cert.pl/en/posts/2026/04/CVE-2026-41991/","tags":["third-party-advisory","Broken Link","advisory","web","article","report"]},{"url":"https://www.gnu.org/software/gzip/","tags":["product","Product","web","article","report"]},{"url":"https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269","tags":["patch","Patch","fix","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41991","tags":["advisory","web"]},{"url":"https://cert.pl/en/posts/2026/04/CVE-2026-41991","tags":["web"]},{"url":"https://www.gnu.org/software/gzip","tags":["web"]},{"url":"https://github.com/advisories/GHSA-67v8-88jf-4x6q","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-41991","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61623","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41991","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41992","tags":["report"]},{"url":"https://bugzilla.redhat.com/2494158","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-61623.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61625","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-61625.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65998","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-65998.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-41991","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1783514299.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1783934943.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41992","tags":["advisory"]},{"url":"https://cgit.git.savannah.gnu.org/cgit/gzip.git/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41991.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41991","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0245.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35849","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8512-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2969","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2970","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2971","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2972","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2997","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33771","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41911","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33771.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41991","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61623.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41992","tags":["advisory"]},{"url":"https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61625.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65998.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:79717","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79717.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61623","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61625","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:65998","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622753-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269622","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41991","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622818-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622906-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622918-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263241-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263269-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41991","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8733-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8733-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41992","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-41991","title":"Predictable Temporary File in GNU gzip","description":"GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269","status":"published","published":"2026-06-29T10:15:50.766Z","modified":"2026-06-29T13:31:46.581Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T13:40:57.334596Z"}],"euvd":[{"id":"EUVD-2026-40068","description":"GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269","status":"published","published":"2026-06-29T10:15:50Z","modified":"2026-06-29T13:31:46Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T18:20:22.87152Z"}],"ghsa":[{"id":"GHSA-67v8-88jf-4x6q","title":"GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file...","description":"GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269","status":"published","published":"2026-06-29T12:31:44Z","modified":"2026-07-01T15:34:56Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T15:09:07.798056Z"}],"nvd":[{"id":"CVE-2026-41991","description":"GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269","status":"published","published":"2026-06-29T12:16:29.77Z","modified":"2026-10-25T21:10:00.77Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:12:26.508751Z"}],"osv":[{"id":"ALPINE-CVE-2026-41991","description":"GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269","status":"published","published":"2026-06-29T12:16:29.77Z","modified":"2026-11-05T01:30:03.032942921Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-05T01:42:21.768346Z"},{"id":"BELL-CVE-2026-41991","status":"published","published":"2026-07-01T06:03:02.144524Z","modified":"2026-11-10T07:15:04.459172698Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-10T07:24:04.128851Z"},{"id":"CVE-2026-41991","title":"Predictable Temporary File in GNU gzip","description":"GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269","status":"published","published":"2026-06-29T10:15:50.766Z","modified":"2026-11-08T02:30:45.431657081Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-377"],"updated_at":"2026-11-11T11:06:45.459796Z"},{"id":"DEBIAN-CVE-2026-41991","description":"GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.  This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269","status":"published","published":"2026-06-29T12:16:29.77Z","modified":"2026-10-26T11:47:33.825000703Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"JLSEC-2026-1264","title":"GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file...","description":"GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269","status":"published","published":"2026-08-12T16:09:57.324Z","modified":"2026-08-12T16:28:54.168034483Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-2969","title":"gzip security update","description":"gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz.\r\n\r\nSecurity Fix(es):\n\nGNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)\n\nGNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.975954257Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2970","title":"gzip security update","description":"gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz.\r\n\r\nSecurity Fix(es):\n\nGNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)\n\nGNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.166085813Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2971","title":"gzip security update","description":"gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz.\r\n\r\nSecurity Fix(es):\n\nGNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)\n\nGNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.926795612Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2972","title":"gzip security update","description":"gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz.\r\n\r\nSecurity Fix(es):\n\nGNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)\n\nGNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.925768826Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2997","title":"gzip security update","description":"gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz.\r\n\r\nSecurity Fix(es):\n\nGNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)\n\nGNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.123502088Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:33771","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-01T10:19:51Z","modified":"2026-10-10T10:07:45Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:61623","title":"Red Hat Security Advisory: gzip security update","status":"published","published":"2026-09-01T10:28:31Z","modified":"2026-10-10T10:16:05Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61625","title":"Red Hat Security Advisory: gzip security update","status":"published","published":"2026-09-01T10:28:32Z","modified":"2026-10-10T10:16:06Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:65998","title":"Red Hat Security Advisory: gzip security update","status":"published","published":"2026-09-10T10:17:07Z","modified":"2026-10-10T10:17:32Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:79717","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-10T10:22:52Z","modified":"2026-10-10T10:35:25.297173992Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:61623","title":"Moderate: gzip security update","description":"The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.\n\nSecurity Fix(es):\n\n* gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility (CVE-2026-41991)\n\n* gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-01T06:05:33.619213Z","modified":"2026-09-01T06:30:02.748528834Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:61625","title":"Moderate: gzip security update","description":"The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.\n\nSecurity Fix(es):\n\n* gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility (CVE-2026-41991)\n\n* gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-01T12:09:39.323272Z","modified":"2026-09-01T12:30:02.533086467Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:65998","title":"Moderate: gzip security update","description":"The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.\n\nSecurity Fix(es):\n\n* gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility (CVE-2026-41991)\n\n* gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-10T06:01:10.763933Z","modified":"2026-09-10T06:30:34.670703434Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-41991","description":"GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269","status":"published","published":"2026-06-29T12:16:00Z","modified":"2026-09-23T14:41:41.49569646Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"ALSA-2026:61623","title":"Moderate: gzip security update","description":"The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.  \n\nSecurity Fix(es):  \n\n  * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility (CVE-2026-41991)\n  * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:32:36.989688405Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:61625","title":"Moderate: gzip security update","description":"The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.  \n\nSecurity Fix(es):  \n\n  * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility (CVE-2026-41991)\n  * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:30:48.600227034Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:65998","title":"Moderate: gzip security update","description":"The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.  \n\nSecurity Fix(es):  \n\n  * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility (CVE-2026-41991)\n  * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-10-29T11:02:29.273954988Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2026-1783514299","title":"gzip: Fix of CVE-2026-41991","description":"- CVE-2026-41991: fix a race when creating a temporary file in gzexe and zdiff\n  on platforms lacking mktemp","status":"published","published":"2026-07-08T12:38:36Z","modified":"2026-10-26T09:30:10.170162115Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783934943","title":"gzip: Fix of 2 CVEs","description":"- CVE-2026-41991: fix a race when creating a temporary file in gzexe and zdiff\n  on platforms lacking mktemp","status":"published","published":"2026-07-13T09:29:20Z","modified":"2026-10-26T09:31:14.906720137Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"MGASA-2026-0245","title":"Updated gzip package fixes security vulnerabilities","description":"The updated package fixes security vulnerabilities:\nPredictable Temporary File in GNU gzip. (CVE-2026-41991)\nGlobal Buffer Overflow in GNU gzip. (CVE-2026-41992)\n","status":"published","published":"2026-07-13T21:24:46Z","modified":"2026-07-13T21:30:06.109637375Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11174-1","title":"gzip-1.14-2.1 on GA media","description":"These are all security issues fixed in the gzip-1.14-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-02T00:00:00Z","modified":"2026-07-03T11:00:05.595656993Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21371-1","title":"Security update for gzip","description":"This update for gzip fixes the following issue\n\n- CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the\n  user's PATH (bsc#1269622).\n","status":"published","published":"2026-07-18T08:12:44Z","modified":"2026-07-22T18:25:10.907451013Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-41991","title":"CVE-2026-41991 in gzip - Patched by Root","description":"Root has patched CVE-2026-41991 in the gzip package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T13:39:56Z","modified":"2026-08-20T15:00:07.661337774Z","updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-41991","title":"CVE-2026-41991 in gzip - Patched by Root","description":"Root has patched CVE-2026-41991 in the gzip package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T11:01:45Z","modified":"2026-08-26T01:10:16.36795372Z","updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-41991","title":"CVE-2026-41991 in gzip - Patched by Root","description":"Root has patched CVE-2026-41991 in the gzip package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-24T06:48:27Z","modified":"2026-10-08T19:00:06.992755431Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:22753-1","title":"Security update for gzip","description":"This update for gzip fixes the following issue\n\n- CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the\n  user's PATH (bsc#1269622).\n","status":"published","published":"2026-07-18T08:14:12Z","modified":"2026-07-23T18:24:19.501249187Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22818-1","title":"Security update for gzip","description":"This update for gzip fixes the following issue\n\n- CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the\n  user's PATH (bsc#1269622).\n","status":"published","published":"2026-07-18T08:14:12Z","modified":"2026-07-28T18:24:07.829253778Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22906-1","title":"Security update for gzip","description":"This update for gzip fixes the following issue\n\n- CVE-2026-41991: insecure temporary file handling in the `gzexe` utility when the `mktemp` utility is not available in\n  a user's `PATH` (bsc#1269622).\n","status":"published","published":"2026-07-24T07:22:19Z","modified":"2026-07-28T18:24:17.192868969Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22918-1","title":"Security update for gzip","description":"This update for gzip fixes the following issue\n\n- CVE-2026-41991: insecure temporary file handling in the `gzexe` utility when the `mktemp` utility is not available in\n  a user's `PATH` (bsc#1269622).\n","status":"published","published":"2026-07-23T11:09:40Z","modified":"2026-07-28T18:24:19.442989714Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3241-1","title":"Security update for gzip","description":"This update for gzip fixes the following issue:\n\n- CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the\n  user's PATH (bsc#1269622).\n","status":"published","published":"2026-07-24T13:06:52Z","modified":"2026-07-28T18:24:20.080806166Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3269-1","title":"Security update for gzip","description":"This update for gzip fixes the following issue:\n\n- CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the\n  user's PATH (bsc#1269622).\n","status":"published","published":"2026-07-27T11:00:57Z","modified":"2026-07-28T10:00:08.582130856Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8512-1","title":"gzip vulnerabilities","description":"It was discovered that Gzip's gzexe utility handled temporary files in an\ninsecure manner. When the mktemp utility was not available, gzexe\nconstructed a temporary file path based on the process ID, which could be\npredicted. A local attacker could possibly use this issue to overwrite\narbitrary files via a symlink attack. (CVE-2026-41991)\n\nIt was discovered that Gzip incorrectly handled certain compressed files.\nAn attacker could possibly use this issue to obtain sensitive information\nor cause Gzip to crash, resulting in a denial of service. (CVE-2026-41992)","status":"published","published":"2026-07-06T12:52:06Z","modified":"2026-07-06T20:44:29.397826088Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8733-1","title":"gzip vulnerabilities","description":"Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe\nutility created temporary files in an insecure manner when mktemp was\nunavailable. A local attacker could possibly use this issue to overwrite\narbitrary files. (CVE-2026-41991)\n\nElias Hasas, Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip incorrectly\nhandled certain compressed files. An attacker could possibly use this\nissue to obtain sensitive information or cause Gzip to crash, resulting\nin a denial of service. (CVE-2026-41992)","status":"published","published":"2026-09-07T12:23:00Z","modified":"2026-09-08T19:57:20.262905891Z","updated_at":"2026-11-02T16:58:26.907654Z"},{"id":"USN-8733-2","title":"gzip vulnerabilities","description":"USN-8733-1 fixed vulnerabilities in Gzip. This update provides the\ncorresponding fix for Gzip on Ubuntu 14.04 LTS, Ubuntu 18.04 LTS and Ubuntu\n20.04 LTS.\n\nOriginal advisory details:\n\n Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe\nutility created temporary files in an insecure manner when mktemp was\nunavailable. A local attacker could possibly use this issue to overwrite\narbitrary files. (CVE-2026-41991)\n\n Elias Hasas, Michał Majchrowicz and Marcin Wyczechowski discovered that\nGzip incorrectly handled certain compressed files. An attacker could\npossibly use this issue to obtain sensitive information or cause Gzip to\ncrash, resulting in a denial of service. (CVE-2026-41992)","status":"published","published":"2026-09-22T16:04:21Z","modified":"2026-09-23T18:57:40.680939669Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}