Read the docs
TI-2026-30386 Aliases CVE-2026-41992GHSA-qxh4-rprf-2mmj

Global Buffer Overflow in GNU gzip

Priority LOW 31CWE-126Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 6 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-126 and the CVSS impact.

Summary

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer. This issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0062 49th percentileScored 2026-11-07
Fix Partial Red Hat: 7 advisoriesRed Hat: 6 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNUgzipup to 1.14—No fix listedCNA
  • gzip VendorGNU Affected up to 1.14 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gnu:gzip:*:*:*:*:*:*:*:*up to 1.14VulnerableGNU
  • cpe:2.3:a:gnu:gzip:*:*:*:*:*:*:*:* Versions up to 1.14 Vulnerable ·GNU

Remediation

Red Hat 7 advisories

  • RHSA-2026:79717 Released 2026-10-08 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images gzip-1.15-1.hum1@aarch64, gzip-1.15-1.hum1@src, gzip-1.15-1.hum1@x86_64
  • RHSA-2026:66018 Released 2026-09-09 · Red Hat rating Important
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:65998 Released 2026-09-09 · Red Hat rating Moderate
    gzip security update
    • Red Hat Enterprise Linux BaseOS (v. 8) gzip-1.9-15.el8_10
Show 4 more Red Hat advisories
  • RHSA-2026:61783 Released 2026-08-31 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:61623 Released 2026-08-31 · Red Hat rating Moderate
    gzip security update
    • Red Hat Enterprise Linux BaseOS (v. 9) gzip-1.12-2.el9_8
  • RHSA-2026:61625 Released 2026-08-31 · Red Hat rating Moderate
    gzip security update
    • Red Hat Enterprise Linux BaseOS (v. 10) gzip-1.13-4.el10_2
  • RHSA-2026:37764 Released 2026-07-10 · Red Hat rating Low
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images gzip-1.14-2.3.hum1@aarch64, gzip-1.14-2.3.hum1@src, gzip-1.14-2.3.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Red Hat Discovery 2Fixed RHSA-2026:61783
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:61625
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:65998
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:61623
Red Hat Hardened ImagesFixed RHSA-2026:37764, RHSA-2026:79717
Red Hat Update Infrastructure 5Fixed RHSA-2026:66018
Not affected: 1 product
  • Red Hat Discovery 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41992
  2. 2026-10-03 Alias added: GHSA-qxh4-rprf-2mmj
  3. 2026-10-09 Fix available: RHSA-2026:79717 · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat

References

Patch 2

Advisory 1

Other 1

  • TI-2022-01156 Improper input validation in gzip, xz-utils CVSS 3.1HIGH 8.8
  • TI-2004-00544 gzexe in gzip 1.3.3 and earlier will execute an argument when the creation of a temp file… CVSS 2.0HIGH 10.0
  • TI-2010-00001 Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit… CVSS 2.0MEDIUM 6.8
  • TI-2001-01181 Buffer overflows in gzip 1.3x, 1.2.4, and other versions might allow attackers to execute… CVSS 2.0HIGH 7.5
  • TI-2009-02508 The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman)… CVSS 2.0MEDIUM 6.8
  • TI-2005-01163 Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote… CVSS 2.0MEDIUM 5.0
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences