GNU gzip up to 1.14 LZH Decoder buffer over-read

Summaryinfo

A vulnerability described as problematic has been identified in GNU gzip up to 1.14. Impacted is an unknown function of the component LZH Decoder. The manipulation results in buffer over-read. This vulnerability is known as CVE-2026-41992. It is possible to launch the attack remotely. No exploit is available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in GNU gzip up to 1.14. Affected is an unknown code block of the component LZH Decoder. The manipulation with an unknown input leads to a buffer over-read vulnerability. CWE is classifying the issue as CWE-126. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. This is going to have an impact on confidentiality. CVE summarizes:

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer. This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681

The weakness was published by Michał Majchrowicz. The advisory is available at cert.pl. This vulnerability is traded as CVE-2026-41992 since 04/23/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-40069). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• GNU

Name

• gzip

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion