GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer. This issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.

redhat RHSA-2026:61625: RHSA-2026:61625: gzip security update (Moderate)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61623 advisory.

    The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular     files. It replaces them with files containing the .gz extension, while retaining ownership modes, access,     and modification times.

    Security Fix(es):

    * gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility     (CVE-2026-41991)

    * gzip: gzip: Information disclosure via global buffer overflow in LZH decompression (CVE-2026-41992)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21666-1 advisory.

    - CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared     global state       between different decompression formats within a single execution (bsc#1269623, bsc#1272554).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the gzip-1.12-2.el9 build changelog.

  - GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper     reuse of shared global state between different decompression formats within a single execution. GNU gzip     maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not     reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW     file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the     shared global state and subsequently trigger an outofbounds read in the LZH decoder. The LZH     decompression logic follows stale values left in the shared array, causing reads past the end of the     allocated global buffer. This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681     (CVE-2026-41992)

  - GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When     the mktemp utility is not available in the user's PATH, gzexe falls back to constructing a temporary file     path based solely on the process ID (PID). This predictable filename is created without exclusive access     or existence checks. A local attacker can precreate the predicted temporary file path as a symbolic link     pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and     overwrites the target file, resulting in a timeofcheck to timeofuse (TOCTOU) condition that allows     arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269     (CVE-2026-41991)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099524 advisory.

    GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper     reuse of shared global state between different decompression formats within a single execution. GNU gzip     maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not     reinitialized between files processed in the same invocation.
    By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d     command, an attacker can poison the shared global state and subsequently trigger an outofbounds read     in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing     reads past the end of the allocated global buffer.

    This issue has been fixed in the commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3592-1 advisory.

    - CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared     global state       between different decompression formats within a single execution (bsc#1269623).
    - Crafted LZW file followed by a crafted LZH file can cause an out-of-bounds memory buffer access     (bsc#1272554).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3590-1 advisory.

    - CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared     global state       between different decompression formats within a single execution (bsc#1269623).
    - crafted LZW file followed by a crafted LZH file can cause an out-of-bounds memory buffer access     (bsc#1272554).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8512-1 advisory.

    It was discovered that Gzip's gzexe utility handled temporary files in an insecure manner. When the mktemp     utility was not available, gzexe constructed a temporary file path based on the process ID, which could be     predicted. A local attacker could possibly use this issue to overwrite arbitrary files via a symlink     attack. (CVE-2026-41991)

    It was discovered that Gzip incorrectly handled certain compressed files. An attacker could possibly use     this issue to obtain sensitive information or cause Gzip to crash, resulting in a denial of service.
    (CVE-2026-41992)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper     reuse of shared global state between different decompression formats within a single execution. GNU gzip     maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not     reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW     file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the     shared global state and subsequently trigger an outofbounds read in the LZH decoder. The LZH     decompression logic follows stale values left in the shared array, causing reads past the end of the     allocated global buffer. This issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and     e7378c2d421be6a286922374425680bbe9ad8b7d. (CVE-2026-41992)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341730	RHEL 9 : gzip (RHSA-2026:61623)	Nessus	Red Hat Local Security Checks	Local	medium
341542	openSUSE 16 Security Update : gzip (openSUSE-SU-2026:21666-1)	Nessus	SuSE Local Security Checks	Local	medium
339713	CentOS 9 : gzip-1.12-2.el9	Nessus	CentOS Local Security Checks	Local	medium
336309	Unity Linux 20.1070e Security Update: gzip (UTSA-2026-099524)	Nessus	Unity Linux Local Security Checks	Local	medium
335325	SUSE SLED15 / SLES15 Security Update : gzip (SUSE-SU-2026:3592-1)	Nessus	SuSE Local Security Checks	Local	medium
335086	SUSE SLES12 Security Update : gzip (SUSE-SU-2026:3590-1)	Nessus	SuSE Local Security Checks	Local	medium
325426	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Gzip vulnerabilities (USN-8512-1)	Nessus	Ubuntu Local Security Checks	Local	medium
323756	Linux Distros Unpatched Vulnerability : CVE-2026-41992	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-41992

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium