See how zsh compares to other vendors in security performance
AMD. A buffer overflow issue was addressed with improved memory handling.
zsh. An authorization issue was addressed with improved state management.
An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.
An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.
Last updated 24 July 2024
zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.
Last updated 25 August 2025
zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.
Last updated 25 August 2025
A flaw was found in zsh prior 5.4.2. There is a crash when copying empty hash table with typeset -p.
Resources: https://sourceforge.net/p/zsh/code/ci/c2cc8b0fbefc9868fa83537f5b6d90fc1ec438dd
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.
In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATHMAX characters.
A flaw was found in zsh prior 5.3.1. There was no check when copying to the internal xbuf2 for a preliminary test.
References: https://sourceforge.net/p/zsh/code/ci/c7a9cf465dd620ef48d586026944d9bd7a0d5d6d
A flaw was found in zsh prior 5.0.7. There is a buffer overflow for very long fds in >& fd syntax.
References: https://sourceforge.net/p/zsh/code/ci/49a3086bb67575435251c70ee598e2fd406ef055
Util/difflog.pl in zsh 4.3.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files.