The vulnerability in GNU gzip arises from a global buffer overflow caused by the reuse of a shared global array among LZ77, LZW, and LZH decompression routines without reinitialization between files processed in the same gzip invocation. By decompressing a specially crafted LZW file followed by a crafted LZH file in a single gzip -d command, an attacker can manipulate the shared global state to trigger an out-of-bounds read in the LZH decoder. This leads to buffer over-read conditions. The problem has been addressed and fixed in commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681.

The vulnerability allows an attacker to cause out-of-bounds reads during decompression, which may lead to information disclosure or application instability. The CVSS 4.0 score is 6.9 (medium severity), indicating a locally exploitable issue that does not require user interaction or privileges but has high impact on confidentiality. There are no known exploits in the wild at this time.

A fix for this vulnerability has been implemented in the referenced commit (63dbf6b3b9e6e781df1a6a64e609b10e23969681). Users should update to a version of GNU gzip that includes this fix. Patch status is not explicitly stated beyond the commit; therefore, verify with the official GNU gzip source or vendor advisory for the availability of updated releases containing this fix.