GNU gzip up to 1.14 Gzexe Utility temp file

Summaryinfo

A vulnerability classified as problematic has been found in GNU gzip up to 1.14. The affected element is an unknown function of the component Gzexe Utility. This manipulation causes temp file. This vulnerability is handled as CVE-2026-41991. It is possible to launch the attack on the local host. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability has been found in GNU gzip up to 1.14 and classified as problematic. Affected by this vulnerability is some unknown processing of the component Gzexe Utility. The manipulation with an unknown input leads to a temp file vulnerability. The CWE definition for the vulnerability is CWE-377. Creating and using insecure temporary files can leave application and system data vulnerable to attack. As an impact it is known to affect integrity. The summary by CVE is:

GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269

The weakness was released by Michał Majchrowicz. It is possible to read the advisory at cert.pl. This vulnerability is known as CVE-2026-41991 since 04/23/2026. The exploitation appears to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-40068). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• GNU

Name

• gzip

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion