GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21371-1 advisory.

    This update for gzip fixes the following issue

    - CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not     available in the       user's PATH (bsc#1269622).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8512-1 advisory.

    It was discovered that Gzip's gzexe utility handled temporary files in an insecure manner. When the mktemp     utility was not available, gzexe constructed a temporary file path based on the process ID, which could be     predicted. A local attacker could possibly use this issue to overwrite arbitrary files via a symlink     attack. (CVE-2026-41991)

    It was discovered that Gzip incorrectly handled certain compressed files. An attacker could possibly use     this issue to obtain sensitive information or cause Gzip to crash, resulting in a denial of service.
    (CVE-2026-41992)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When     the mktemp utility is not available in the user's PATH, gzexe falls back to constructing a temporary file     path based solely on the process ID (PID). This predictable filename is created without exclusive access     or existence checks. A local attacker can precreate the predicted temporary file path as a symbolic link     pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and     overwrites the target file, resulting in a timeofcheck to timeofuse (TOCTOU) condition that allows     arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269     (CVE-2026-41991)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
328922	openSUSE 16 Security Update : gzip (openSUSE-SU-2026:21371-1)	Nessus	SuSE Local Security Checks	low
325426	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Gzip vulnerabilities (USN-8512-1)	Nessus	Ubuntu Local Security Checks	medium
323739	Linux Distros Unpatched Vulnerability : CVE-2026-41991	Nessus	Misc.	low

Detections

Analytics

CVE-2026-41991

low

Tenable Plugins

low

medium

low