Red Hat Security Advisory: lrzsz security, bug fix, and enhancement update

Lrzsz, a modified zmodem/ymodem/xmodem package for Linux systems, contains two security vulnerabilities: CVE-2026-105840 allows arbitrary file overwrite through absolute path traversal in restricted mode, and CVE-2026-105841 enables arbitrary command execution via crafted file names in pipe mode. These vulnerabilities affect Red Hat Enterprise Linux 10 across multiple architectures (x86_64, s390x, ppc64le, aarch64) including extended update support versions. Red Hat has released updated lrzsz packages that address these security issues along with other bug fixes and enhancements. The vendor advisory classifies the security impact as Important and provides instructions for applying the update. No known exploits in the wild have been reported at this time.

Successful exploitation of CVE-2026-105840 could allow an attacker to overwrite arbitrary files via absolute path traversal when lrzsz is used in restricted mode. CVE-2026-105841 could enable arbitrary command execution through specially crafted file names in pipe mode. These vulnerabilities could lead to unauthorized modification of files and execution of commands, potentially compromising system integrity and security. The advisory rates the impact as Important (high severity).

Red Hat has released updated lrzsz packages for Red Hat Enterprise Linux 10 and its extended update support versions that fix these vulnerabilities. Users should apply these official updates as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the issues. No additional mitigation steps are indicated beyond applying the vendor-provided patches.