The vulnerability in GNU gzip's gzexe utility arises from insecure temporary file creation when mktemp is not in the user's PATH. The fallback method uses a temporary filename derived solely from the process ID, which is predictable and created without exclusive access or existence checks. This enables a local attacker to pre-create a symbolic link at the expected temporary file path pointing to an arbitrary writable file. When gzexe executes, it follows the symlink and overwrites the target file, resulting in a TOCTOU condition and arbitrary file overwrite. The issue is tracked as CWE-377 and has been fixed in a specific commit (4e6f8b24ab823146ab8776f0b7fe486ab34d4269).

A local attacker can exploit this vulnerability to overwrite arbitrary files writable by the victim by leveraging predictable temporary file paths and symbolic links. This can lead to unauthorized file modification. The CVSS score is low (2.0), indicating limited impact and requiring local access with high attack complexity.

A fix has been committed addressing this vulnerability. However, no official patch release or vendor advisory is provided in the available data. Users should update gzip to a version including the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 or later once available. Until then, avoid running gzexe in environments where mktemp is unavailable or ensure mktemp is present in the PATH to prevent fallback to the insecure method.