CVE-2026-41991
Fixed in a distro release EPSS <1%CVSS 2.0
GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269
Products: gnu gzip
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | gzip | 1.13-4.el10_2 |
| AlmaLinux 8 | gzip | 1.9-15.el8_10 |
| AlmaLinux 9 | gzip | 1.12-2.el9_8 |
| Debian 12 | gzip | no fix |
| Debian 13 | gzip | 1.13-1+deb13u1 |
| Debian 14 | gzip | 1.14-1 |
| Red Hat Enterprise Linux 10.2 | gzip | 0:1.13-4.el10_2 |
| Red Hat Enterprise Linux 10.2 | gzip-debuginfo | 0:1.13-4.el10_2 |
| Red Hat Enterprise Linux 10.2 | gzip-debugsource | 0:1.13-4.el10_2 |
| Red Hat Enterprise Linux 8 | gzip | 0:1.9-15.el8_10 |
| Red Hat Enterprise Linux 8 | gzip-debuginfo | 0:1.9-15.el8_10 |
| Red Hat Enterprise Linux 8 | gzip-debugsource | 0:1.9-15.el8_10 |
| Red Hat Enterprise Linux 9 | gzip | 0:1.12-2.el9_8 |
| Red Hat Enterprise Linux 9 | gzip-debuginfo | 0:1.12-2.el9_8 |
| Red Hat Enterprise Linux 9 | gzip-debugsource | 0:1.12-2.el9_8 |
| Red Hat hummingbird 1 | gzip | 0:1.14-2.2.hum1 |
| Red Hat hummingbird 1 | gzip | 0:1.15-1.hum1 |
| Rocky Linux 10 | gzip | 0:1.13-4.el10_2 |
| Rocky Linux 8 | gzip | 0:1.9-15.el8_10 |
| Rocky Linux 9 | gzip | 0:1.12-2.el9_8 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise Micro 5.3 | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise Micro 5.4 | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise Micro 5.5 | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | gzip | 1.10-4.17.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise Server 16.0 | gzip | 1.13-160000.3.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | gzip | 1.10-4.17.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | gzip | 1.10-150200.13.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | gzip | 1.13-160000.3.1 |
| SUSE Linux Micro 6.0 | gzip | 1.13-2.1 |
| SUSE Linux Micro 6.1 | gzip | 1.13-slfo.1.1_3.1 |
| SUSE Linux Micro 6.2 | gzip | 1.13-160000.3.1 |
| Ubuntu 22.04 LTS | gzip | 1.10-4ubuntu4.2 |
| Ubuntu 24.04 LTS | gzip | 1.12-1ubuntu3.2 |
| Ubuntu 25.10 | gzip | no fix |
| Ubuntu 26.04 LTS | gzip | 1.14-1~exp2ubuntu1.1 |
| Ubuntu Pro 14.04 LTS | gzip | 1.6-3ubuntu1+esm2 |
| Ubuntu Pro 16.04 LTS | gzip | 1.6-4ubuntu1+esm2 |
| Ubuntu Pro 18.04 LTS | gzip | 1.6-5ubuntu1.2+esm1 |
| Ubuntu Pro 20.04 LTS | gzip | 1.10-0ubuntu4.1+esm1 |
| openSUSE Leap 16.0 | gzip | 1.13-160000.3.1 |
| openSUSE Tumbleweed | gzip | 1.14-2.1 |