CVE-2026-105842 in lrzsz
Summary
by MITRE • 10/06/2026
lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in versions of lrzsz prior to release 0.13.0 represents a critical security flaw within the receive utility component known as lrz. This specific implementation defect is classified under CWE-122, which denotes a heap-based buffer overflow condition. The root cause lies in the procheader function, where the application fails to adequately validate or bound-check filenames supplied by the remote sender during ZMODEM file transfer operations. In this context, the software allocates a fixed-size buffer named Pathname with insufficient capacity relative to the maximum potential input size allowed by the protocol implementation.
When an attacker acts as a malicious ZMODEM sender, they can exploit this lack of bounds checking by transmitting filenames that exceed the allocated memory space for the Pathname variable. The vulnerability manifests through two distinct code paths depending on the operational mode of lrz. In pipe mode, the application utilizes sprintf to copy the incoming filename data into the buffer without verifying length constraints. Alternatively, in standard modes, strcpy is employed for this operation. Both functions are inherently unsafe when handling untrusted input because they do not perform boundary checks before writing data to memory. Consequently, if a sender provides a filename approaching or exceeding 8192 bytes, the write operations will spill over the allocated heap boundaries into adjacent memory regions.
The operational impact of this heap-based buffer overflow is severe and multifaceted. The immediate consequence is the corruption of heap metadata and potentially other critical data structures residing in contiguous memory blocks. This corruption typically leads to application instability, resulting in a crash or denial of service for the lrz process. However, beyond simple disruption, such memory corruption vulnerabilities are frequently exploitable for arbitrary code execution. An attacker with precise control over the overflow payload could manipulate return addresses or function pointers within the corrupted heap structure, thereby gaining the ability to execute malicious commands on the target system under the privileges of the user running lrz. This transforms a simple denial-of-service issue into a potential remote code execution vector, significantly elevating the risk profile for systems relying on this utility for file transfers over potentially untrusted networks.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK techniques related to exploitation for privilege escalation or initial access if leveraged in conjunction with other vectors. The specific mechanism of using malformed input during protocol negotiation phases corresponds to common patterns observed in network service exploits where trust boundaries are assumed rather than enforced. Organizations utilizing lrzsz must recognize that the ZMODEM protocol, while legacy and less commonly used today compared to SFTP or SCP, still presents attack surfaces if not properly hardened against malicious inputs.
To mitigate this vulnerability, immediate action is required by upgrading the lrzsz package to version 0.13.0 or later, where these bounds-checking issues have been addressed in the source code. Developers and system administrators should ensure that all instances of lrz are updated across their infrastructure. In environments where updating may not be immediately feasible due to legacy dependencies, implementing network-level controls such as firewalls or intrusion prevention systems can help filter out excessively large ZMODEM packets before they reach the vulnerable application layer. Additionally, adopting strict input validation practices in any custom wrappers or scripts that invoke lrz can provide an additional layer of defense by truncating filenames to safe lengths prior to passing them to the binary. Regular patch management and vulnerability scanning remain essential strategies for maintaining security posture against such memory corruption flaws.