https://seclists.org/oss-sec/2026/q3/550: CVE-2026-41992 gzip 1.14 out-of-bounds memory buffer access

Q: What conditions are required to trigger the out-of-bounds access?

A single gzip -d process must decompress specially crafted LZW data and then specially crafted LZH data. The issue depends on this sequence occurring within the same decompression instance.

Q: Which deployments should be considered affected?

GNU gzip 1.14 and earlier are affected. Systems that use gzip only to decompress data should still assess exposure if they may process attacker-controlled or otherwise untrusted compressed input.

Q: What can be done before gzip 1.15 is available?

Apply the provided patch to gzip 1.14. The patch clears the left and right arrays when LZH Huffman decoding starts, preventing state from a prior LZW decompression from being reused.

Published Aug 23, 2026

Updated

Affected Software

1 affected component

GNU gzip<=1.14

Frequently Asked Questions

What conditions are required to trigger the out-of-bounds access?

A single gzip -d process must decompress specially crafted LZW data and then specially crafted LZH data. The issue depends on this sequence occurring within the same decompression instance.

Which deployments should be considered affected?

GNU gzip 1.14 and earlier are affected. Systems that use gzip only to decompress data should still assess exposure if they may process attacker-controlled or otherwise untrusted compressed input.

What can be done before gzip 1.15 is available?

Apply the provided patch to gzip 1.14. The patch clears the left and right arrays when LZH Huffman decoding starts, preventing state from a prior LZW decompression from being reused.