Red Hat Security Advisory: lrzsz security, bug fix, and enhancement update

Lrzsz, a modified zmodem/ymodem/xmodem package for Linux, contains two critical security flaws. CVE-2026-105840 allows arbitrary file overwrite through absolute path traversal when operating in restricted mode. CVE-2026-105841 permits arbitrary command execution via specially crafted file names in pipe mode. These vulnerabilities could lead to unauthorized file modification and command execution. Red Hat has released updated lrzsz packages for Red Hat Enterprise Linux 8 across various architectures to address these issues. Additional bug fixes and enhancements are included in the update.

Successful exploitation of CVE-2026-105840 can allow an attacker to overwrite arbitrary files on the system due to improper path validation in restricted mode. CVE-2026-105841 enables arbitrary command execution through crafted file names in pipe mode, potentially allowing an attacker to execute malicious commands. Both vulnerabilities pose a significant risk to system integrity and security if exploited.

Red Hat has released updated lrzsz packages that fix these vulnerabilities. Users should apply the security update RHSA-2026:83525 promptly to remediate these issues. For detailed instructions on applying the update, refer to Red Hat's official advisory and update article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.