Loading story…
CVE-2026-41992 affects gzip 1.14 and earlier, causing an out-of-bounds memory access when one gzip -d process decompresses specially crafted LZW data followed by specially crafted LZH data. The apparent state-reuse flaw is currently understood to require processing two malicious files in a single invocation and is expected to enable an out-of-bounds read and program crash. Michał Majchrowicz and Elias Hasas reported the issue and supplied fixes; Paul Eggert published the disclosure.
Organizations running affected gzip packages should apply the patch that clears the left and right arrays in huf_decode_start() or upgrade to gzip 1.15 when available. CentOS 9 security updates address CVE-2026-41992 alongside CVE-2026-41991. The advisory rates the issue as medium severity, while scanner metadata presents differing exploitability vectors; no known exploitation has been reported.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Solar Designer said the then-unconfirmed understanding was that exploitation requires gzip to process two files in one invocation, rather than one file or stream containing both formats. He assessed the likely consequence as an out-of-bounds read that crashes the program.
Paul Eggert disclosed CVE-2026-41992 affecting gzip 1.14 and earlier on oss-sec. Specially crafted LZW data followed by LZH data in one gzip -d process can trigger the flaw; users were advised to apply the patch or upgrade to gzip 1.15 when available.
A patch associated with CVE-2026-41992 was published. The mitigation clears the reused left and right decompression arrays in gzip's huf_decode_start() routine.
Solar Designer stated that the gzip issue had previously been brought to the linux-distros list on July 25.
CVE-2026-41992 was published for an out-of-bounds memory buffer access flaw in gzip.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcetenable.com
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical global buffer overflow vulnerability has been identified in the *zlib* untgz utility, specifically affecting version 1.3.1.2. The flaw resides in the `TGZfname()` function, where an unbounded `strcpy()` operation copies user-supplied archive names from command-line arguments into a fixed-size global buffer of 1,024 bytes without proper length validation. Security researchers demonstrated that supplying an archive name exceeding this limit can trigger an out-of-bounds write, leading to memory corruption, denial-of-service, or potentially arbitrary code execution, depending on system configuration and compiler settings. The vulnerability, tracked as `CVE-2026-22184` with a CVSS score of 9.3, is trivially exploitable via command-line input and does not require any archive parsing or validation to trigger. Successful exploitation was confirmed using AddressSanitizer, which detected a global buffer overflow when the utility was invoked with a 4,096-byte filename. The issue is classified under CWE-120 (Buffer Copy without Checking Size of Input) and poses significant risk to systems utilizing the affected version of the untgz utility for archive extraction or processing.
Jun 29, 2026
Researchers disclosed **CVE-2026-48095**, a critical heap buffer overflow in 7-Zip affecting version `26.00` and earlier that can lead to application crashes, denial of service, or arbitrary code execution. The bug, reported by Jaroslav Lobačevski of GitHub Security Lab and tracked in advisory `GHSL-2026-140`, resides in the NTFS archive handler’s `CInStream::GetCuSize()` logic, where an under-allocation can shrink a buffer to 1 byte before a later operation writes up to 256 MB of attacker-controlled data into it. The resulting heap corruption can overwrite adjacent objects, including a stream object’s **vtable** pointer, creating a path to code execution. The vulnerability can be triggered simply by opening a specially crafted file because 7-Zip uses signature-based fallback detection and may route files disguised as `.7z`, `.zip`, or `.rar` into the vulnerable NTFS parser regardless of extension. Reports say both 32-bit and 64-bit builds are affected, with 64-bit systems that have sufficient memory more likely to reach reliable code execution, while lower-memory systems may instead crash. Public disclosure included technical details and a Python proof-of-concept generator, raising the risk of weaponization; the issue carries a **CVSS 3.1 score of 8.8**, and users are being urged to update 7-Zip and avoid opening untrusted archives.
Jun 29, 2026
A newly disclosed **7-Zip** vulnerability, tracked as `CVE-2026-14266`, allows remote code execution via a heap-based buffer overflow in the handling of crafted **XZ chunked data**. An attacker can trigger the flaw if a user opens a malicious archive or is lured to content that delivers a specially crafted XZ payload, causing code to run with the privileges of the current user. The issue is considered significant because 7-Zip is widely deployed and the attack path can be readily paired with phishing or malicious attachments. The bug was reported by Landon Peng of Lunbun LLC through coordinated disclosure, and the Zero Day Initiative published advisory **`ZDI-26-444`** after the fix became available. **7-Zip version 26.02**, released on June 25, 2026, contains the patch, and reporting said no public proof-of-concept or in-the-wild exploitation had been confirmed at publication. The flaw was assigned a **CVSS 7.0** score, reflecting the need for user interaction and a relatively complex exploit path, and users were urged to update and avoid opening untrusted compressed files.
Jul 24, 2026