lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792503867 advisory.

  - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode     that allows malicious ZMODEM senders to write files outside the current directory using absolute     pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-     pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving     user. (CVE-2026-105840)

  - lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode     that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a     suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to     popen(), so shell metacharacters execute as the receiving user. (CVE-2026-105841)

  - lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive     utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply     filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap     memory and crash lrz. (CVE-2026-105842)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792503867 advisory.

  - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode     that allows malicious ZMODEM senders to write files outside the current directory using absolute     pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-     pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving     user. (CVE-2026-105840)

  - lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode     that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a     suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to     popen(), so shell metacharacters execute as the receiving user. (CVE-2026-105841)

  - lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive     utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply     filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap     memory and crash lrz. (CVE-2026-105842)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792053113 advisory.

  - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode     that allows malicious ZMODEM senders to write files outside the current directory using absolute     pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-     pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving     user. (CVE-2026-105840)

  - lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode     that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a     suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to     popen(), so shell metacharacters execute as the receiving user. (CVE-2026-105841)

  - lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive     utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply     filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap     memory and crash lrz. (CVE-2026-105842)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive     utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply     filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap     memory and crash lrz. (CVE-2026-105842)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367934	Rocky Linux 9.6 [TuxCare] Security Update: lrzsz Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792503867)	Nessus	Rocky Linux Local Security Checks	Local	high
367916	AlmaLinux 9.6 [TuxCare] Security Update: lrzsz Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792503867)	Nessus	Alma Linux Local Security Checks	Local	high
366112	AlmaLinux 9.2 [TuxCare] Security Update: lrzsz Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792053113)	Nessus	Alma Linux Local Security Checks	Local	high
363426	Linux Distros Unpatched Vulnerability : CVE-2026-105842	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-105842

medium

Tenable Plugins

high

high

high

medium