In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.

An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.

A flaw was found in zsh prior 5.3.1. There was no check when copying to the internal xbuf2 for a preliminary test.

References: https://sourceforge.net/p/zsh/code/ci/c7a9cf465dd620ef48d586026944d9bd7a0d5d6d

A flaw was found in zsh prior 5.0.7. There is a buffer overflow for very long fds in >& fd syntax.

References: https://sourceforge.net/p/zsh/code/ci/49a3086bb67575435251c70ee598e2fd406ef055

AMD. A buffer overflow issue was addressed with improved memory handling.

Last updated 25 August 2025

A flaw was found in zsh prior 5.4.2. There is a crash when copying empty hash table with typeset -p.

Resources: https://sourceforge.net/p/zsh/code/ci/c2cc8b0fbefc9868fa83537f5b6d90fc1ec438dd

Last updated 25 August 2025

Util/difflog.pl in zsh 4.3.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files.