GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269

euleros EulerOS-SA-2026-3341: An update for gzip is now available for EulerOS V2.0SP12

euleros EulerOS-SA-2026-3266: An update for gzip is now available for EulerOS V2.0SP12(x86_64)

According to the versions of the gzip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper     reuse of shared global state between different decompression formats within a single execution. GNU gzip     maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not     reinitialized between files processed in the same invocation.
    By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d     command, an attacker can poison the shared global state and subsequently trigger an outofbounds read     in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing     reads past the end of the allocated global buffer.

    This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681(CVE-2026-41992)

    GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When     the mktemp utility is not available in the user's PATH, gzexe falls back to constructing a temporary file     path based solely on the process ID (PID). This predictable filename is created without exclusive access     or existence checks.
    A local attacker can pre-create the predicted temporary file path as a symbolic link pointing to an     arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target     file, resulting in a time-of-check to time-of-use (TOCTOU) condition that allows arbitrary file overwrite.

    This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269(CVE-2026-41991)

Tenable has extracted the preceding description block directly from the EulerOS gzip security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-616250 advisory.

    [1.13-4]
    - Fix an issue with a temporary file creations when mktemp is missing (41991)
    - Fix a global buffer overflow vulnerability in the LZH decompression logic (41992)     Resolves: CVE-2026-41991     Resolves: CVE-2026-41992

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1737:01 advisory.

    * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility     (CVE-2026-41991)
      * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-616230 advisory.

    [1.12-2]
    - Fix an issue with a temporary file creations when mktemp is missing (41991)
    - Fix a global buffer overflow vulnerability in the LZH decompression logic (41992)     Resolves: CVE-2026-41991     Resolves: CVE-2026-41992

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61625 advisory.

    * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility     (CVE-2026-41991)

    * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:61625 advisory.

    * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility     (CVE-2026-41991)
      * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61623 advisory.

    * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility     (CVE-2026-41991)

    * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:61623 advisory.

    * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility     (CVE-2026-41991)
      * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61625 advisory.

    The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular     files. It replaces them with files containing the .gz extension, while retaining ownership modes, access,     and modification times.

    Security Fix(es):

    * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility     (CVE-2026-41991)

    * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61623 advisory.

    The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular     files. It replaces them with files containing the .gz extension, while retaining ownership modes, access,     and modification times.

    Security Fix(es):

    * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility     (CVE-2026-41991)

    * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the gzip-1.12-2.el9 build changelog.

  - GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper     reuse of shared global state between different decompression formats within a single execution. GNU gzip     maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not     reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW     file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the     shared global state and subsequently trigger an outofbounds read in the LZH decoder. The LZH     decompression logic follows stale values left in the shared array, causing reads past the end of the     allocated global buffer. This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681     (CVE-2026-41992)

  - GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When     the mktemp utility is not available in the user's PATH, gzexe falls back to constructing a temporary file     path based solely on the process ID (PID). This predictable filename is created without exclusive access     or existence checks. A local attacker can precreate the predicted temporary file path as a symbolic link     pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and     overwrites the target file, resulting in a timeofcheck to timeofuse (TOCTOU) condition that allows     arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269     (CVE-2026-41991)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099505 advisory.

    GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When     the mktemp utility is not available in the users PATH, gzexe falls back to constructing a temporary     file path based solely on the process ID (PID). This predictable filename is created without exclusive     access or existence checks.
    A local attacker can precreate the predicted temporary file path as a symbolic link pointing to an     arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target     file, resulting in a timeofcheck to timeofuse (TOCTOU) condition that allows arbitrary file     overwrite.

    This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3269-1 advisory.

    This update for gzip fixes the following issue:

    - CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not     available in the       user's PATH (bsc#1269622).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3241-1 advisory.

    This update for gzip fixes the following issue:

    - CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not     available in the       user's PATH (bsc#1269622).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21371-1 advisory.

    This update for gzip fixes the following issue

    - CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not     available in the       user's PATH (bsc#1269622).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8512-1 advisory.

    It was discovered that Gzip's gzexe utility handled temporary files in an insecure manner. When the mktemp     utility was not available, gzexe constructed a temporary file path based on the process ID, which could be     predicted. A local attacker could possibly use this issue to overwrite arbitrary files via a symlink     attack. (CVE-2026-41991)

    It was discovered that Gzip incorrectly handled certain compressed files. An attacker could possibly use     this issue to obtain sensitive information or cause Gzip to crash, resulting in a denial of service.
    (CVE-2026-41992)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When     the mktemp utility is not available in the user's PATH, gzexe falls back to constructing a temporary file     path based solely on the process ID (PID). This predictable filename is created without exclusive access     or existence checks. A local attacker can precreate the predicted temporary file path as a symbolic link     pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and     overwrites the target file, resulting in a timeofcheck to timeofuse (TOCTOU) condition that allows     arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269     (CVE-2026-41991)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
343683	EulerOS 2.0 SP12 : gzip (EulerOS-SA-2026-3341)	Nessus	Huawei Local Security Checks	Local	medium
343645	EulerOS 2.0 SP12 : gzip (EulerOS-SA-2026-3266)	Nessus	Huawei Local Security Checks	Local	medium
342719	Oracle Linux 10 : ELSA-2026-61625-0: / gzip (ELSA-2026-616250)	Nessus	Oracle Linux Local Security Checks	Local	medium
342354	MiracleLinux 9 : gzip-1.12-2.el9_8 (AXSA:2026-1737:01)	Nessus	Miracle Linux Local Security Checks	Local	medium
342200	Oracle Linux 9 : ELSA-2026-61623-0: / gzip (ELSA-2026-616230)	Nessus	Oracle Linux Local Security Checks	Local	medium
342169	RockyLinux 10 : gzip (RLSA-2026:61625)	Nessus	Rocky Linux Local Security Checks	Local	medium
342160	AlmaLinux 10 : gzip (ALSA-2026:61625)	Nessus	Alma Linux Local Security Checks	Local	medium
342153	RockyLinux 9 : gzip (RLSA-2026:61623)	Nessus	Rocky Linux Local Security Checks	Local	medium
342134	AlmaLinux 9 : gzip (ALSA-2026:61623)	Nessus	Alma Linux Local Security Checks	Local	medium
342036	RHEL 10 : gzip (RHSA-2026:61625)	Nessus	Red Hat Local Security Checks	Local	medium
341730	RHEL 9 : gzip (RHSA-2026:61623)	Nessus	Red Hat Local Security Checks	Local	medium
339713	CentOS 9 : gzip-1.12-2.el9	Nessus	CentOS Local Security Checks	Local	medium
336806	Unity Linux 20.1070e Security Update: gzip (UTSA-2026-099505)	Nessus	Unity Linux Local Security Checks	Local	low
330329	SUSE SLED15 / SLES15 Security Update : gzip (SUSE-SU-2026:3269-1)	Nessus	SuSE Local Security Checks	Local	low
330313	SUSE SLES12 Security Update : gzip (SUSE-SU-2026:3241-1)	Nessus	SuSE Local Security Checks	Local	low
328922	openSUSE 16 Security Update : gzip (openSUSE-SU-2026:21371-1)	Nessus	SuSE Local Security Checks	Local	low
325426	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Gzip vulnerabilities (USN-8512-1)	Nessus	Ubuntu Local Security Checks	Local	medium
323739	Linux Distros Unpatched Vulnerability : CVE-2026-41991	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-41991

low

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

low

low

low

low

medium

low