CVE-2026-41992: Global Buffer Overflow in GNU gzip
Global Buffer Overflow in GNU gzip
Other sources
GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.13-2 - Upgrade
Upgrade
GNU gzip 1.14to a version that resolves this vulnerability.Fixed in 1.14Patch CVE-2026-41992 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 63dbf6b3b9e6e781df1a6a64e609b10e23969681 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch e7378c2d421be6a286922374425680bbe9ad8b7d - Compensating control
Avoid processing multiple gzip members of different compression formats (e.g., decompressing specially crafted LZW followed by specially crafted LZH) within a single gzip -d invocation; instead, decompress them in separate invocations to prevent poisoning of shared global state across formats.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41992?
CVE-2026-41992 has a risk rating of 37, indicating it is a significant vulnerability.
How do I fix CVE-2026-41992?
To mitigate CVE-2026-41992, update GNU gzip to the latest version that includes the patch for this vulnerability.
What causes the vulnerability in CVE-2026-41992?
CVE-2026-41992 is caused by a global buffer overflow in GNU gzip's LZH decompression logic due to improper reuse of shared global state.
Which software is affected by CVE-2026-41992?
The CVE-2026-41992 vulnerability affects the GNU gzip software.
What type of vulnerability is CVE-2026-41992 classified as?
CVE-2026-41992 is classified as a Buffer Overflow vulnerability.