PT-2026-53256 · Gnu · Gzip

Marcin Wyczechowski + 1 · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-41992

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions GNU gzip (affected versions not specified)

Description An issue exists in the LZH decompression logic where shared global state is improperly reused between different decompression formats during a single execution. The software maintains a global array shared across LZ77, LZW, and LZH routines that is not reinitialized between processed files. An attacker can poison this shared state by decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single command, triggering an out-of-bounds read in the LZH decoder as it follows stale values left in the shared array.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Over-read

Weakness Enumeration

CWE-126

Related Identifiers

CVE-2026-41992

Affected Products

Gzip

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-41992 · Security Note
• https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681 · Patch
• https://cert.pl/en/posts/2026/04/CVE-2026-41991 · Note
• https://twitter.com/VulmonFeeds/status/2071579534839754947 · Twitter Post
• https://gnu.org/software/gzip · Note