{"id":"CVE-2026-41992","aliases":["ALPINE-CVE-2026-41992","ALSA-2026:61623","ALSA-2026:61625","ALSA-2026:65998","AZL-91406","BELL-CVE-2026-41992","CLSA-2026-1783416812","CLSA-2026-1783417026","CLSA-2026-1783524887","CLSA-2026-1783588305","CLSA-2026-1783588532","CLSA-2026-1783588603","CLSA-2026-1783588865","CLSA-2026-1783589056","CLSA-2026-1783589413","CLSA-2026-1783632145","CLSA-2026-1783632526","CLSA-2026-1785139899","CLSA-2026-1786976234","DEBIAN-CVE-2026-41992","EUVD-2026-40069","GHSA-qxh4-rprf-2mmj","JLSEC-2026-1265","MGASA-2026-0245","OESA-2026-2969","OESA-2026-2970","OESA-2026-2971","OESA-2026-2972","OESA-2026-2997","RHSA-2026:37764","RHSA-2026:61623","RHSA-2026:61625","RHSA-2026:65998","RHSA-2026:79717","RLSA-2026:61623","RLSA-2026:61625","RLSA-2026:65998","ROOT-OS-DEBIAN-11-CVE-2026-41992","ROOT-OS-DEBIAN-12-CVE-2026-41992","ROOT-OS-DEBIAN-13-CVE-2026-41992","SUSE-SU-2026:23356-1","SUSE-SU-2026:23363-1","SUSE-SU-2026:23392-1","SUSE-SU-2026:23550-1","SUSE-SU-2026:3590-1","SUSE-SU-2026:3592-1","UBUNTU-CVE-2026-41992","USN-8512-1","USN-8733-1","USN-8733-2","openSUSE-SU-2026:11518-1","openSUSE-SU-2026:21666-1"],"status":"published","title":"Global Buffer Overflow in GNU gzip","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0062,"percentile":0.5003,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-126"],"published":"2026-06-29T10:15:57Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"gzip","fixed_in":["1.13-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gzip","fixed_in":["1.14-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gzip","fixed_in":["1.14-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gzip","fixed_in":["1.14-r3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"gzip","fixed_in":["1.13-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"gzip","fixed_in":["1.12-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"gzip","fixed_in":["1.14-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"gzip","fixed_in":["1.14-r1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"gzip","fixed_in":["1.9-12.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"gzip","fixed_in":["1.9-12.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"gzip","fixed_in":["1.10-0ubuntu4.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"gzip-win32","fixed_in":["1.10-0ubuntu4.1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"gzip","fixed_in":["1.9-13.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"gzip","fixed_in":["1.5-11.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"gzip","fixed_in":["1.6-5ubuntu1.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"gzip-win32","fixed_in":["1.6-5ubuntu1.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"gzip","fixed_in":["1.3.12-24.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"gzip","fixed_in":["1.6-4ubuntu1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"gzip","fixed_in":["1.5-11.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"gzip","fixed_in":["1.3.12-24.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gzip","fixed_in":["1.9-3+deb10u1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"gzip-win32","fixed_in":["1.9-3+deb10u1+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"gzip","fixed_in":["1.5-11.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gzip","fixed_in":["1.12-1.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gzip","fixed_in":["1.13-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gzip","fixed_in":["1.14-1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gzip","fixed_in":["0:1.14-2.3.hum1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"gzip","fixed_in":["1.10-4+deb11u1.aikido.2","1.10-4+deb11u1.aikido.3","1.10-4+deb11u1.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-gzip","fixed_in":["1.10-4+deb11u1.aikido.2","1.10-4+deb11u1.aikido.3","1.10-4+deb11u1.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"gzip","fixed_in":["1.12-1.aikido.2","1.12-1.aikido.3","1.12-1.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-gzip","fixed_in":["1.12-1.aikido.2","1.12-1.aikido.3","1.12-1.root.io.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"gzip","fixed_in":["1.13-slfo.1.1_4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"gzip","fixed_in":["1.13-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"gzip","fixed_in":["1.13-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gzip","fixed_in":["1.13-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gzip","fixed_in":["1.13-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gzip","fixed_in":["1.10-4.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gzip","fixed_in":["1.10-150200.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gzip","fixed_in":["1.10-150200.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gzip","fixed_in":["1.10-150200.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gzip","fixed_in":["1.10-150200.16.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gzip","fixed_in":["1.6-3ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gzip","fixed_in":["1.6-4ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gzip","fixed_in":["1.6-5ubuntu1.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gzip","fixed_in":["1.10-0ubuntu4.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gzip","fixed_in":["1.10-4ubuntu4.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gzip","fixed_in":["1.12-1ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"gzip","fixed_in":["1.14-1~exp2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gzip","fixed_in":["1.14-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gzip","fixed_in":["1.13-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-r3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-15.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12-r1"},{"fixed":"1.12-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14-r0"},{"fixed":"1.14-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12-r2"},{"fixed":"1.14-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-12.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-12.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-0ubuntu4.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"gzip-win32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-0ubuntu4.1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-13.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-11.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-5ubuntu1.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"gzip-win32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-5ubuntu1.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.12-24.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-4ubuntu1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-11.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.12-24.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-3+deb10u1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"gzip-win32","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-3+deb10u1+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-11.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12-1","1.12-1.1","1.12-1.2","1.13-1","1.13.56~e549-1~exp1","1.14-1","1.14-1~exp1","1.14-1~exp2"]},{"source":"osv","ecosystem":"Debian:13","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-1+deb13u1"}]}],"versions":["1.13-1"]},{"source":"osv","ecosystem":"Debian:14","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1"}]}],"versions":["1.13-1","1.13.56~e549-1~exp1","1.14-1~exp1","1.14-1~exp2"]},{"source":"osv","ecosystem":"Julia","package":"Gzip_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-2.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-7.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-3.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-7.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-7.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-2.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"gzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"gzip-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"gzip-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9-15.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9-15.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gzip-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9-15.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15-1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12-2.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-4.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9-15.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:11","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4+deb11u1.aikido.2"},{"fixed":"1.10-4+deb11u1.aikido.3"},{"fixed":"1.10-4+deb11u1.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4+deb11u1.aikido.2"},{"fixed":"1.10-4+deb11u1.aikido.3"},{"fixed":"1.10-4+deb11u1.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.aikido.2"},{"fixed":"1.12-1.aikido.3"},{"fixed":"1.12-1.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.aikido.2"},{"fixed":"1.12-1.aikido.3"},{"fixed":"1.12-1.root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-slfo.1.1_4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-150200.16.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-3ubuntu1+esm2"}]}],"versions":["1.6-2ubuntu1","1.6-3ubuntu1","1.6-3ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-4ubuntu1+esm2"}]}],"versions":["1.6-4ubuntu1","1.6-4ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-5ubuntu1.2+esm1"}]}],"versions":["1.6-5ubuntu1","1.6-5ubuntu1.1","1.6-5ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-0ubuntu4.1+esm1"}]}],"versions":["1.10-0ubuntu3","1.10-0ubuntu4","1.10-0ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4ubuntu4.2"}]}],"versions":["1.10-4ubuntu1","1.10-4ubuntu2","1.10-4ubuntu3","1.10-4ubuntu4","1.10-4ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1ubuntu3.2"}]}],"versions":["1.12-1ubuntu1","1.12-1ubuntu2","1.12-1ubuntu3","1.12-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13-1ubuntu3","1.13-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1~exp2ubuntu1.1"}]}],"versions":["1.13-1ubuntu4","1.13-1ubuntu5","1.14-1~exp2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-4ubuntu4.2"}]}],"versions":["1.10-4ubuntu1","1.10-4ubuntu2","1.10-4ubuntu3","1.10-4ubuntu4","1.10-4ubuntu4.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1ubuntu3.2"}]}],"versions":["1.12-1ubuntu1","1.12-1ubuntu2","1.12-1ubuntu3","1.12-1ubuntu3.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-1~exp2ubuntu1.1"}]}],"versions":["1.13-1ubuntu4","1.13-1ubuntu5","1.14-1~exp2ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-4ubuntu1+esm2"}]}],"versions":["1.6-4ubuntu1","1.6-4ubuntu1+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-3ubuntu1+esm2"}]}],"versions":["1.6-2ubuntu1","1.6-3ubuntu1","1.6-3ubuntu1+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-5ubuntu1.2+esm1"}]}],"versions":["1.6-5ubuntu1","1.6-5ubuntu1.1","1.6-5ubuntu1.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10-0ubuntu4.1+esm1"}]}],"versions":["1.10-0ubuntu3","1.10-0ubuntu4","1.10-0ubuntu4.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gzip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-160000.4.1"}]}]}],"products":[{"vendor":"gnu","product":"gzip"},{"vendor":"open source","product":"gzip"}],"references":[{"url":"https://cert.pl/en/posts/2026/04/CVE-2026-41991/","tags":["third-party-advisory","Broken Link","advisory","web","article","report"]},{"url":"https://www.gnu.org/software/gzip/","tags":["product","Product","web","article","report"]},{"url":"https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681","tags":["patch","Patch","fix","web","article"]},{"url":"https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d","tags":["patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/23/1","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/25/1","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/27/2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41992","tags":["web","advisory"]},{"url":"https://cert.pl/en/posts/2026/04/CVE-2026-41991","tags":["web"]},{"url":"https://www.gnu.org/software/gzip","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qxh4-rprf-2mmj","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-41992","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61623","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41991","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41992","tags":["report"]},{"url":"https://bugzilla.redhat.com/2494158","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-61623.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61625","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-61625.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65998","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-65998.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-41992","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1783416812.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1783417026.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1783524887.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1783588305.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1783588532.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1783588603.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1783588865.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1783589056.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1783589413.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1783632145.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1783632526.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1785139899.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1786976234.html","tags":["advisory"]},{"url":"https://cgit.git.savannah.gnu.org/cgit/gzip.git/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41992.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41992","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0245.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35849","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8512-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2969","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41991","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2970","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2971","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2972","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2997","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37764","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37764.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41992","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494158","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61623.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41991","tags":["advisory"]},{"url":"https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61625.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65998.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:79717","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79717.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61623","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:61625","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:65998","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623356-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269623","tags":["report"]},{"url":"https://bugzilla.suse.com/1272554","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41992","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623363-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623392-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623550-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263590-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263592-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41992","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8733-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8733-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41991","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-41992","title":"Global Buffer Overflow in GNU gzip","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.","status":"published","published":"2026-06-29T10:15:57.278Z","modified":"2026-08-27T11:39:40.63Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-40069","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.","status":"published","published":"2026-06-29T10:15:57Z","modified":"2026-08-27T11:39:40Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:28.581047Z"}],"ghsa":[{"id":"GHSA-qxh4-rprf-2mmj","title":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by...","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681","status":"published","published":"2026-06-29T12:31:44Z","modified":"2026-08-27T15:32:31Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T15:11:03.315113Z"}],"nvd":[{"id":"CVE-2026-41992","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.","status":"published","published":"2026-06-29T12:16:29.94Z","modified":"2026-10-25T21:10:00.77Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T14:12:26.508751Z"}],"osv":[{"id":"ALPINE-CVE-2026-41992","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.","status":"published","published":"2026-06-29T12:16:29.94Z","modified":"2026-10-01T02:17:49.286717419Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-41992","status":"published","published":"2026-07-04T06:04:31.606526Z","modified":"2026-07-16T07:15:05.195103259Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-41992","title":"Global Buffer Overflow in GNU gzip","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.","status":"published","published":"2026-06-29T10:15:57.278Z","modified":"2026-11-08T02:47:36.463376666Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-126"],"updated_at":"2026-11-07T03:08:05.086112Z"},{"id":"DEBIAN-CVE-2026-41992","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.  This issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.","status":"published","published":"2026-06-29T12:16:29.94Z","modified":"2026-10-26T11:47:29.820428105Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"JLSEC-2026-1265","title":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by...","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681","status":"published","published":"2026-08-12T16:09:57.324Z","modified":"2026-08-12T16:28:53.402013204Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-2969","title":"gzip security update","description":"gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz.\r\n\r\nSecurity Fix(es):\n\nGNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)\n\nGNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.975954257Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2970","title":"gzip security update","description":"gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz.\r\n\r\nSecurity Fix(es):\n\nGNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)\n\nGNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.166085813Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2971","title":"gzip security update","description":"gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz.\r\n\r\nSecurity Fix(es):\n\nGNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)\n\nGNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.926795612Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2972","title":"gzip security update","description":"gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz.\r\n\r\nSecurity Fix(es):\n\nGNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)\n\nGNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.925768826Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2997","title":"gzip security update","description":"gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz.\r\n\r\nSecurity Fix(es):\n\nGNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.\nA local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.\n\nThis issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)\n\nGNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.123502088Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:37764","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-05T10:12:23Z","modified":"2026-10-10T10:09:02Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:61623","title":"Red Hat Security Advisory: gzip security update","status":"published","published":"2026-09-01T10:28:31Z","modified":"2026-10-10T10:16:05Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61625","title":"Red Hat Security Advisory: gzip security update","status":"published","published":"2026-09-01T10:28:32Z","modified":"2026-10-10T10:16:06Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:65998","title":"Red Hat Security Advisory: gzip security update","status":"published","published":"2026-09-10T10:17:07Z","modified":"2026-10-10T10:17:32Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:79717","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-10T10:22:52Z","modified":"2026-10-10T10:35:25.297173992Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:61623","title":"Moderate: gzip security update","description":"The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.\n\nSecurity Fix(es):\n\n* gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility (CVE-2026-41991)\n\n* gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-01T06:05:33.619213Z","modified":"2026-09-01T06:30:02.748528834Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:61625","title":"Moderate: gzip security update","description":"The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.\n\nSecurity Fix(es):\n\n* gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility (CVE-2026-41991)\n\n* gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-01T12:09:39.323272Z","modified":"2026-09-01T12:30:02.533086467Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:65998","title":"Moderate: gzip security update","description":"The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.\n\nSecurity Fix(es):\n\n* gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility (CVE-2026-41991)\n\n* gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-10T06:01:10.763933Z","modified":"2026-09-10T06:30:34.670703434Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-41992","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer. This issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.","status":"published","published":"2026-06-29T12:16:00Z","modified":"2026-09-23T14:41:41.556540656Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"ALSA-2026:61623","title":"Moderate: gzip security update","description":"The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.  \n\nSecurity Fix(es):  \n\n  * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility (CVE-2026-41991)\n  * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:32:36.989688405Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:61625","title":"Moderate: gzip security update","description":"The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.  \n\nSecurity Fix(es):  \n\n  * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility (CVE-2026-41991)\n  * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-31T00:00:00Z","modified":"2026-10-29T11:30:48.600227034Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:65998","title":"Moderate: gzip security update","description":"The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times.  \n\nSecurity Fix(es):  \n\n  * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility (CVE-2026-41991)\n  * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-10-29T11:02:29.273954988Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-91406","title":"CVE-2026-41992 affecting package gzip for versions less than 1.13-2","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.","status":"published","published":"2026-06-29T12:16:29Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1783416812","title":"gzip: Fix of CVE-2026-41992","description":"- CVE-2026-41992: Fix global buffer overflow in LZH decompression caused by reuse of shared decode tables","status":"published","published":"2026-07-07T09:33:49Z","modified":"2026-10-26T09:31:51.12527796Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783417026","title":"gzip: Fix of CVE-2026-41992","description":"- CVE-2026-41992: Fix global buffer overflow in LZH decompression caused by reuse of shared decode tables","status":"published","published":"2026-07-07T09:37:22Z","modified":"2026-10-26T09:31:49.608749708Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783524887","title":"Fix CVE(s): CVE-2026-41992","description":"   * SECURITY UPDATE: global buffer overflow in LZH decompression\n     - debian/patches/CVE-2026-41992.patch: clear shared decode tables in\n       read_c_len() in unlzh.c.\n     - CVE-2026-41992","status":"published","published":"2026-07-08T15:35:02Z","modified":"2026-10-26T09:32:05.538145022Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783588305","title":"gzip: Fix of CVE-2026-41992","description":"- CVE-2026-41992: Fix global buffer overflow in LZH decompression caused by reuse of shared decode tables","status":"published","published":"2026-07-09T09:12:01Z","modified":"2026-10-26T09:31:37.71560909Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783588532","title":"gzip: Fix of CVE-2026-41992","description":"- CVE-2026-41992: out-of-bounds read in the LZH decoder from stale shared\n  decompression state (left/right) reused across a .Z then .lzh file in a\n  single gzip -d invocation","status":"published","published":"2026-07-09T09:15:48Z","modified":"2026-10-26T09:31:55.414046928Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783588603","title":"Fix CVE(s): CVE-2026-41992","description":"   * SECURITY UPDATE: global buffer overflow in LZH decompression\n     - debian/patches/CVE-2026-41992.patch: clear shared decode tables in\n       read_c_len() in unlzh.c.\n     - CVE-2026-41992","status":"published","published":"2026-07-09T09:16:59Z","modified":"2026-10-26T09:32:03.234582846Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783588865","title":"gzip: Fix of CVE-2026-41992","description":"- CVE-2026-41992: out-of-bounds read in the LZH decoder from stale shared\n  decompression state (left/right) reused across a .Z then .lzh file in a\n  single gzip -d invocation","status":"published","published":"2026-07-09T09:21:21Z","modified":"2026-10-26T09:31:45.420354267Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783589056","title":"Fix CVE(s): CVE-2026-41992","description":"   * SECURITY UPDATE: global buffer overflow in LZH decompression\n     - debian/patches/CVE-2026-41992.patch: clear shared decode tables in\n       read_c_len() in unlzh.c.\n     - CVE-2026-41992","status":"published","published":"2026-07-09T09:24:32Z","modified":"2026-10-26T09:31:46.801658303Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783589413","title":"gzip: Fix of CVE-2026-41992","description":"- CVE-2026-41992: out-of-bounds read in the LZH decoder from stale shared\n  decompression state (left/right) reused across a .Z then .lzh file in a\n  single gzip -d invocation","status":"published","published":"2026-07-09T10:05:44Z","modified":"2026-10-26T09:31:41.953814112Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783632145","title":"gzip: Fix of CVE-2026-41992","description":"- CVE-2026-41992: out-of-bounds read in the LZH decoder from stale shared\n  decompression state (left/right) reused across a .Z then .lzh file in a\n  single gzip -d invocation","status":"published","published":"2026-07-11T17:10:43Z","modified":"2026-10-26T09:31:39.305046833Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783632526","title":"Fix CVE(s): CVE-2026-41992","description":"   * SECURITY UPDATE: out-of-bounds read in the LZH decoder from stale shared\n     decompression state (left/right) reused across a .Z then .lzh member in a\n     single gzip -d invocation\n     - debian/patches/CVE-2026-41992.patch: clear left/right when n == 0 in\n       read_c_len() in unlzh.c\n     - CVE-2026-41992","status":"published","published":"2026-07-09T21:29:01Z","modified":"2026-10-26T09:31:52.322342692Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1785139899","title":"gzip: Fix of CVE-2026-41992","description":"- CVE-2026-41992: out-of-bounds read in the LZH decoder from stale shared\n  decompression state (left/right) reused across a .Z then .lzh file in a\n  single gzip -d invocation","status":"published","published":"2026-07-27T08:11:49Z","modified":"2026-10-26T09:31:58.183962886Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1786976234","title":"gzip: Fix of CVE-2026-41992","description":"- CVE-2026-41992: clear shared left/right arrays in read_c_len (n==0)\n  to fix a global-buffer-overflow decompressing .lzh after .Z","status":"published","published":"2026-08-17T14:17:25Z","modified":"2026-10-26T09:30:32.324241715Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"MGASA-2026-0245","title":"Updated gzip package fixes security vulnerabilities","description":"The updated package fixes security vulnerabilities:\nPredictable Temporary File in GNU gzip. (CVE-2026-41991)\nGlobal Buffer Overflow in GNU gzip. (CVE-2026-41992)\n","status":"published","published":"2026-07-13T21:24:46Z","modified":"2026-07-13T21:30:06.109637375Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11518-1","title":"gzip-1.14-3.1 on GA media","description":"These are all security issues fixed in the gzip-1.14-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:04.217549459Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21666-1","title":"Security update for gzip","description":"This update for gzip fixes the following issues:\n\n- CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state\n  between different decompression formats within a single execution (bsc#1269623, bsc#1272554).\n","status":"published","published":"2026-08-27T12:47:41Z","modified":"2026-08-28T18:23:09.612570607Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-41992","title":"CVE-2026-41992 in gzip - Patched by Root","description":"Root has patched CVE-2026-41992 in the gzip package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T13:39:56Z","modified":"2026-08-20T15:00:03.374993313Z","updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-41992","title":"CVE-2026-41992 in gzip - Patched by Root","description":"Root has patched CVE-2026-41992 in the gzip package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T11:01:45Z","modified":"2026-08-26T01:10:52.97060259Z","updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-41992","title":"CVE-2026-41992 in gzip - Patched by Root","description":"Root has patched CVE-2026-41992 in the gzip package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-24T06:48:27Z","modified":"2026-10-08T19:00:06.981173095Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:23356-1","title":"Security update for gzip","description":"This update for gzip fixes the following issues:\n\n- CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state\n  between different decompression formats within a single execution (bsc#1269623).\n- Crafted LZW file followed by a crafted LZH file can cause an out-of-bounds memory buffer access (bsc#1272554).\n","status":"published","published":"2026-08-28T11:13:05Z","modified":"2026-09-10T18:23:12.491348816Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23363-1","title":"Security update for gzip","description":"This update for gzip fixes the following issues:\n\n- CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state\n  between different decompression formats within a single execution (bsc#1269623).\n- crafted LZW file followed by a crafted LZH file can cause an out-of-bounds memory buffer access (bsc#1272554).\n","status":"published","published":"2026-08-28T11:23:15Z","modified":"2026-09-10T18:23:13.247515213Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23392-1","title":"Security update for gzip","description":"This update for gzip fixes the following issues:\n\n- CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state\n  between different decompression formats within a single execution (bsc#1269623, bsc#1272554).\n","status":"published","published":"2026-08-27T12:45:01Z","modified":"2026-09-10T18:23:15.35866572Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23550-1","title":"Security update for gzip","description":"This update for gzip fixes the following issues:\n\n- CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state\n  between different decompression formats within a single execution (bsc#1269623, bsc#1272554).\n","status":"published","published":"2026-08-27T12:45:01Z","modified":"2026-09-29T18:23:08.329447721Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3590-1","title":"Security update for gzip","description":"This update for gzip fixes the following issues:\n\n- CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state\n  between different decompression formats within a single execution (bsc#1269623).\n- crafted LZW file followed by a crafted LZH file can cause an out-of-bounds memory buffer access (bsc#1272554).\n","status":"published","published":"2026-08-12T09:14:07Z","modified":"2026-08-13T09:30:08.119578382Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3592-1","title":"Security update for gzip","description":"This update for gzip fixes the following issues:\n\n- CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state\n  between different decompression formats within a single execution (bsc#1269623).\n- Crafted LZW file followed by a crafted LZH file can cause an out-of-bounds memory buffer access (bsc#1272554).\n","status":"published","published":"2026-08-12T09:15:32Z","modified":"2026-08-13T09:30:08.178430882Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8512-1","title":"gzip vulnerabilities","description":"It was discovered that Gzip's gzexe utility handled temporary files in an\ninsecure manner. When the mktemp utility was not available, gzexe\nconstructed a temporary file path based on the process ID, which could be\npredicted. A local attacker could possibly use this issue to overwrite\narbitrary files via a symlink attack. (CVE-2026-41991)\n\nIt was discovered that Gzip incorrectly handled certain compressed files.\nAn attacker could possibly use this issue to obtain sensitive information\nor cause Gzip to crash, resulting in a denial of service. (CVE-2026-41992)","status":"published","published":"2026-07-06T12:52:06Z","modified":"2026-07-06T20:44:29.397826088Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8733-1","title":"gzip vulnerabilities","description":"Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe\nutility created temporary files in an insecure manner when mktemp was\nunavailable. A local attacker could possibly use this issue to overwrite\narbitrary files. (CVE-2026-41991)\n\nElias Hasas, Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip incorrectly\nhandled certain compressed files. An attacker could possibly use this\nissue to obtain sensitive information or cause Gzip to crash, resulting\nin a denial of service. (CVE-2026-41992)","status":"published","published":"2026-09-07T12:23:00Z","modified":"2026-09-08T19:57:20.262905891Z","updated_at":"2026-11-02T16:58:26.907654Z"}]},"sources_more":{"osv":1}}