CVE-2026-41992 Details

A global buffer overflow vulnerability has been identified in GNU Gzip, specifically within the LZH decompression logic. This issue arises from the improper reuse of shared global state among different decompression formats during a single execution. Gzip maintains a global array that is used across the LZ77, LZW, and LZH decompression routines, which is not reinitialized between files processed in the same session. By decompressing a specially crafted LZW file followed by a crafted LZH file in a single 'gzip -d' command, an attacker can manipulate the shared global state, leading to an out-of-bounds read in the LZH decoder. The LZH logic then follows outdated values in the shared array, causing reads beyond the allocated global buffer.

Users can update to the latest version of GNU Gzip, where this vulnerability has been fixed. The patched version is available on the main GNU download server and its mirrors.