CVE-2026-41991: GNU Gzip Privilege Escalation Vulnerability

CVE-2026-41991 Overview

CVE-2026-41991 is a symbolic link vulnerability in the gzexe utility shipped with GNU gzip. The utility creates temporary files using a predictable path based solely on the process ID (PID) when the mktemp binary is missing from the user's PATH. A local attacker who anticipates the PID can pre-create the target path as a symbolic link, causing gzexe to overwrite an arbitrary file owned or writable by the victim. The weakness maps to insecure temporary file handling [CWE-377] and produces a time-of-check to time-of-use (TOCTOU) race condition. Upstream maintainers fixed the issue in commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269.

Critical Impact
A local, unprivileged attacker can overwrite files writable by a user who runs gzexe, potentially corrupting data or scripts executed by that user.

Affected Products

GNU gzip (all versions prior to the fix commit 4e6f8b24)
Linux and Unix distributions packaging the gzexe utility from vulnerable gzip releases
Environments where mktemp is not present in the executing user's PATH

Discovery Timeline

2026-06-29 - CVE-2026-41991 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-41991

Vulnerability Analysis

The gzexe utility wraps executables inside a self-extracting gzip archive. During execution, the wrapper must decompress payload data to a temporary location before running it. When mktemp is available, gzexe delegates temporary path creation to that helper, which produces unpredictable names and enforces exclusive creation. When mktemp is absent from PATH, gzexe falls back to a legacy code path that constructs the temporary file name from the process ID alone.

The fallback path opens or writes to the constructed filename without using O_EXCL semantics and without verifying that the target is a regular file. This allows a local attacker to plant a symbolic link at the predicted location before gzexe writes to it. The follow-through write dereferences the symlink and clobbers the file it references.

Root Cause

The root cause is insecure temporary file creation [CWE-377] combined with a TOCTOU race. Predictable PID-based naming, absence of exclusive-create flags, and lack of symlink-safe file handling permit an attacker to influence the write target between path construction and the actual file operation.

Attack Vector

Exploitation requires local access on the target system and user interaction: the victim must invoke gzexe on a wrapped executable in an environment where mktemp is not resolvable via PATH. The attacker predicts or brute-forces the PID space, pre-creates the expected /tmp/gzexe.<pid> path as a symlink pointing to a file the victim can write, and waits for gzexe to execute. The vulnerability does not permit remote exploitation and does not directly yield code execution, but arbitrary file overwrite can be chained into privilege escalation depending on which files the victim can write.

No public proof-of-concept exploit is currently listed for this CVE. Refer to the CERT Security Advisory CVE-2026-41991 for additional technical context.

Detection Methods for CVE-2026-41991

Indicators of Compromise

Presence of symbolic links in world-writable directories matching the pattern /tmp/gzexe.<pid> prior to gzexe invocation
Unexpected modification timestamps on user-writable files coinciding with gzexe execution
Shell history entries showing gzexe runs in environments where mktemp is not installed

Detection Strategies

Audit process execution logs for invocations of /usr/bin/gzexe and correlate with concurrent file creation events in /tmp
Monitor openat() and symlinkat() syscalls targeting /tmp/gzexe.* paths using auditd or eBPF-based telemetry
Flag hosts where gzip package versions predate commit 4e6f8b24 and mktemp (from coreutils) is missing from the default PATH

Monitoring Recommendations

Enable file integrity monitoring on user-writable shell profiles, cron files, and application configuration paths that could be targeted by an arbitrary write
Log symlink creation events in /tmp and /var/tmp and alert on names matching known predictable temp-file patterns
Track package inventory for gzip versions across the fleet and surface hosts still running vulnerable builds

How to Mitigate CVE-2026-41991

Immediate Actions Required

Update GNU gzip to a release containing commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 or apply the vendor patch directly
Verify that mktemp (provided by coreutils) is installed and reachable via PATH for all users who may invoke gzexe
Restrict use of gzexe on multi-user systems until the patched version is deployed

Patch Information

The upstream fix is available in the GNU gzip source tree at commit 4e6f8b24. Distribution maintainers should rebuild gzip packages against a source tree that includes this commit. Consult the GNU Gzip Project Information page for release announcements.

Workarounds

Ensure coreutils is installed so that mktemp is present in every user's PATH, forcing gzexe to use the safe code path
Mount /tmp with the nosymfollow option where supported to prevent symlink dereferencing during temporary file writes
Set restrictive umask values and use per-user private temporary directories (for example via pam_namespace or systemdPrivateTmp=) to limit cross-user symlink planting

bash

# Verify mktemp availability and patched gzip
command -v mktemp || echo "mktemp missing - install coreutils"
gzip --version | head -n 1

# Enable per-service private /tmp on systemd units invoking gzexe
# /etc/systemd/system/<service>.service.d/override.conf
# [Service]
# PrivateTmp=yes