Loading story…
GNU released gzip 1.15, a stable update containing 119 commits since version 1.14 and addressing multiple long-standing flaws. Fixes include a race condition that could make gzip delete the wrong file when an ancestor directory is renamed concurrently, use of uninitialized memory when processing malformed input, and a buffer overflow triggered by .lzh decompression following .Z decompression.
The release also corrects .lzh decompression corruption, improves recognition of PKZIP signatures in streamed ZIP data and handling of unusual filename characters, and resolves temporary-file races in some utilities on platforms lacking mktemp. GNU provides signed source archives and SHA-256/SHA3-256 checksums for verification; the update also changes locale handling for filename quoting and removes support for several legacy platforms.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
GNU gzip 1.15 was released as a stable version, succeeding gzip 1.14. The release incorporated 119 commits and fixed multiple long-standing defects, including a wrong-file deletion race, uninitialized-memory handling of malformed input, an .lzh-related buffer overflow, decompression corruption, streamed ZIP handling, and temporary-file races.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2026-41992** affects gzip 1.14 and earlier, causing an out-of-bounds memory access when one `gzip -d` process decompresses specially crafted LZW data followed by specially crafted LZH data. The apparent state-reuse flaw is currently understood to require processing two malicious files in a single invocation and is expected to enable an out-of-bounds read and program crash. Michał Majchrowicz and Elias Hasas reported the issue and supplied fixes; Paul Eggert published the disclosure. Organizations running affected gzip packages should apply the patch that clears the `left` and `right` arrays in `huf_decode_start()` or upgrade to gzip 1.15 when available. CentOS 9 security updates address CVE-2026-41992 alongside CVE-2026-41991. The advisory rates the issue as medium severity, while scanner metadata presents differing exploitability vectors; no known exploitation has been reported.
Aug 27, 2026
GitHub Security Lab disclosed multiple vulnerabilities affecting **7-Zip 26.00 and earlier** and a separate path traversal flaw in the `7zDec` sample extractor from the **LZMA SDK**. The issues span several archive handlers, including **SquashFS, UEFI capsule and firmware parsing, UDF, WIM, and Ar**, and include out-of-bounds reads, uninitialized memory disclosure, integer overflow, and denial-of-service conditions. One SquashFS flaw affects only **32-bit builds**, while several of the bugs reportedly impact versions dating back to the **7-Zip 9.x** line. A fixed release, **7-Zip 26.01**, was published on SourceForge after private reporting by GitHub Security Lab researcher **Jaroslav Lobačevski**. The coordinated disclosure maps the findings to **GHSL-2026-115** through **GHSL-2026-122** and CVEs including `CVE-2026-48092`, `CVE-2026-48101`, `CVE-2026-48102`, `CVE-2026-48103`, `CVE-2026-48104`, `CVE-2026-48111`, and `CVE-2026-48112`; the SDK path traversal bug could allow **arbitrary file write** and potentially lead to **code execution** in affected sample-app implementations.
Jul 20, 2026
A critical global buffer overflow vulnerability has been identified in the *zlib* untgz utility, specifically affecting version 1.3.1.2. The flaw resides in the `TGZfname()` function, where an unbounded `strcpy()` operation copies user-supplied archive names from command-line arguments into a fixed-size global buffer of 1,024 bytes without proper length validation. Security researchers demonstrated that supplying an archive name exceeding this limit can trigger an out-of-bounds write, leading to memory corruption, denial-of-service, or potentially arbitrary code execution, depending on system configuration and compiler settings. The vulnerability, tracked as `CVE-2026-22184` with a CVSS score of 9.3, is trivially exploitable via command-line input and does not require any archive parsing or validation to trigger. Successful exploitation was confirmed using AddressSanitizer, which detected a global buffer overflow when the utility was invoked with a 4,096-byte filename. The issue is classified under CWE-120 (Buffer Copy without Checking Size of Input) and poses significant risk to systems utilizing the affected version of the untgz utility for archive extraction or processing.
Jun 29, 2026