CVE-2026-41992: GNU Gzip Buffer Overflow Vulnerability

CVE-2026-41992 Overview

CVE-2026-41992 is an out-of-bounds read vulnerability in GNU gzip caused by improper reuse of shared global state across decompression formats. The gzip utility maintains a global array used by the LZ77, LZW, and LZH decompression routines. This array is not reinitialized between files processed in a single invocation. An attacker who supplies a crafted LZW file followed by a crafted LZH file to a single gzip -d command can poison this shared state. The LZH decoder then reads past the end of the allocated global buffer, disclosing adjacent memory contents. The issue is tracked under [CWE-126: Buffer Over-read] and has been fixed in commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681.

Critical Impact
Local attackers can trigger an out-of-bounds read in the LZH decoder by chaining crafted LZW and LZH files, exposing process memory contents from the gzip global buffer.

Affected Products

GNU gzip (all versions prior to commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681)
Linux and Unix distributions bundling vulnerable gzip builds
Automated build and archive pipelines invoking gzip -d on untrusted inputs

Discovery Timeline

2026-06-29 - CVE-2026-41992 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-41992

Vulnerability Analysis

GNU gzip supports several legacy decompression formats including LZ77, LZW, and LZH. These decoders share a single global array that stores intermediate state such as prefix tables and code buffers. The shared allocation is sized appropriately for the format currently in use, but the code does not reinitialize the array when processing multiple files within one invocation of gzip -d.

When a crafted LZW file is decompressed first, it leaves attacker-influenced values inside the shared buffer. If a crafted LZH file is decompressed next in the same command, the LZH routine follows those stale values as if they were valid LZH decoder state. The resulting index calculations exceed the LZH allocation size and the decoder reads past the end of the global buffer.

The outcome is a local information disclosure. Memory adjacent to the gzip global buffer can be returned as decompressed output or influence subsequent decoder behavior. The vulnerability is not exploitable remotely and requires the victim to process attacker-supplied files in a single gzip invocation.

Root Cause

The root cause is missing reinitialization of shared global state between successive files and between different decompression formats. The LZH decoder trusts that the global array reflects LZH state, but the LZW decoder may have populated it with values that produce out-of-bounds indices during LZH decoding.

Attack Vector

Exploitation requires local access and the ability to influence which files are passed to gzip -d in a single command. A typical scenario involves a script or automated pipeline that batches multiple archives from an untrusted source. The attacker delivers an LZW file followed by an LZH file crafted to abuse the poisoned state.

The vulnerability manifests during normal decompression. No privilege escalation or user interaction beyond invocation of the decoder is required. See the GNU Gzip patch commit for the exact code paths affected.

Detection Methods for CVE-2026-41992

Indicators of Compromise

Presence of unexpected .Z (LZW) and .lzh files processed together by the same gzip -d command
Abnormal gzip process output containing binary data inconsistent with the input archive contents
gzip processes reading multiple archive files from world-writable or user-controlled directories

Detection Strategies

Inventory installed gzip versions across Linux and Unix hosts and flag builds predating commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681
Audit shell scripts, cron jobs, and CI pipelines that pass multiple files to a single gzip -d invocation
Monitor for gzip invocations that mix legacy compression formats (LZW .Z and LZH .lzh) in one command

Monitoring Recommendations

Log command-line arguments to gzip through auditd or equivalent process auditing to identify multi-file invocations
Alert on gzip decompression jobs that operate on files sourced from untrusted upload directories
Track distribution package updates to ensure patched gzip binaries are deployed after vendor releases

How to Mitigate CVE-2026-41992

Immediate Actions Required

Update gzip to a build that includes commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681 as soon as your distribution publishes the fix
Avoid passing multiple archive files from untrusted sources to a single gzip -d command until patched
Restrict directory permissions so that automated gzip jobs cannot process attacker-controlled inputs

Patch Information

The upstream fix is committed to the GNU gzip source tree as commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681. The patch reinitializes the shared decompression buffer between files and between format transitions. Refer to the GNU gzip commit and the GNU Gzip Project page for release details, and to the CERT.PL advisory for related analysis.

Workarounds

Invoke gzip -d on a single file at a time so shared global state cannot carry between formats
Sandbox gzip decompression under a low-privilege account or within a container to limit exposure of adjacent memory
Validate archive file types before decompression and reject legacy .Z or .lzh inputs from untrusted sources

bash

# Configuration example: process archives individually and reject legacy formats
for archive in /var/uploads/*.gz; do
  case "$archive" in
    *.Z|*.lzh) echo "Rejecting legacy format: $archive"; continue ;;
  esac
  gzip -d -- "$archive"
done