CVE-2026-41992: GNU gzip Global Buffer Over-Read in LZH Decompression

Technical summary

The vulnerability stems from inadequate isolation of global state in gzip's decompression pipeline. GNU gzip maintains a shared global array used by LZ77, LZW, and LZH decoders. This array is not reinitialized when transitioning between different file formats within a single invocation. An attacker exploits this by first decompressing a crafted LZW file that leaves malicious state in the global array, then decompressing a crafted LZH file. The LZH decoder consumes stale values from the unpurged array, causing out-of-bounds read operations past the end of the allocated buffer. The root cause is CWE-126 (Buffer Over-read), which allows information disclosure without memory corruption or code execution. The issue has been resolved in commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681.

Business impact

Information disclosure is the primary risk. An attacker can extract sensitive data from server process memory by triggering out-of-bounds reads. This is particularly concerning for systems that decompress untrusted archives or accept gzip files from external sources. While the vulnerability does not enable code execution or denial of service, the confidentiality breach could expose secrets, credentials, or proprietary data. Organizations relying on gzip for processing user-supplied compressed files face elevated exposure. The high CVSS score (7.5) reflects the ease of exploitation and the confidentiality impact, though the lack of integrity or availability effects limits broader service disruption.

Affected systems

All versions of GNU gzip prior to the fix commit are affected. Any deployment processing multiple compressed files in a single gzip invocation—such as batch decompression pipelines, container image layers, or automated archive extraction—is vulnerable. Systems accepting LZH-compressed files from untrusted sources are at highest risk. The vulnerability requires both LZW and LZH files to be present in the same decompression session, limiting exposure to workflows that handle heterogeneous compression formats or accept polymorphic archives.

Exploitability

Exploitation is straightforward and requires no special privileges. An attacker only needs to craft two compressed files and trigger their decompression in a single gzip command. The attack is reliable once the two files are prepared, and there are no mitigating factors such as authentication requirements or user interaction. The network-accessible attack vector (CVSS AV:N) means remote systems can deliver the malicious files via HTTP, FTP, or other protocols. No local access or special configuration is necessary. The simplicity of the attack—carefully prepared input files—makes this a practical threat if gzip processes untrusted archives.

Remediation

Update GNU gzip to a version that includes commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681 or later. Verify the exact patched version by consulting the official GNU gzip release notes or your distribution's security advisories, as version numbering varies across maintainers. As an interim mitigation, restrict gzip operations to trusted input files and avoid processing heterogeneous archives (mixing LZW and LZH formats) in a single invocation. Decompress files sequentially in separate processes or sandboxed containers to prevent global state pollution.

Patch guidance

After updating gzip, verify the fix by confirming the commit hash in your installed version (use 'gzip --version' or check the source repository). Test decompression of both LZH and LZW files independently to ensure functionality is preserved. Monitor your deployment for any changes in gzip behavior, particularly when handling multi-format archives. If you maintain custom gzip builds, cherry-pick commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681 into your branch and rebuild. Verify against your vendor's advisory for the specific patched version number applicable to your environment.

Detection guidance

Monitor process-level activity for gzip invocations that process multiple file types in sequence, particularly combinations of LZW and LZH formats. Log decompression errors or segmentation faults from gzip, which may indicate exploitation attempts. Use static analysis to identify code paths that call gzip on user-controlled input without file type validation. Implement file integrity monitoring to detect unexpected reads from gzip process memory during decompression. YARA or similar rules can flag suspicious file sequences (LZW followed by LZH) in archive pipelines. Consider deploying a wrapper script that enforces single-format-per-invocation policies for gzip operations.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score, ease of exploitation, and information disclosure impact. The attack requires only two crafted input files and no special privileges, making it practical for attackers. Unlike code-execution bugs, information disclosure may go undetected, allowing silent data exfiltration. Organizations processing untrusted archives or exposing gzip to network input should prioritize patching. However, it does not appear on the CISA KEV list, suggesting real-world active exploitation has not yet been documented at scale. Nonetheless, the low barrier to exploitation warrants proactive patching before threat actors develop tooling.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication required and low attack complexity. The confidentiality impact is rated high (C:H), indicating significant information disclosure potential. Integrity (I:N) and availability (A:N) are unaffected, preventing code execution or denial of service. The lack of KEV designation and active exploitation reporting suggests the threat is currently theoretical, but the simplicity of the attack and the practical scenarios where gzip processes heterogeneous archives elevate real-world risk. Organizations should treat this as a high-priority patch but not as a critical emergency requiring out-of-band deployment.

Frequently asked questions