Security update for gzip

CVE-2026-41992 is a global buffer overflow vulnerability in GNU gzip's LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. An attacker can exploit this by providing a specially crafted LZW file followed by a specially crafted LZH file to the gzip -d command, resulting in out-of-bounds memory reads. This may lead to information disclosure, such as leaking cryptographic keys or memory addresses, and can also cause a denial of service via application crash. The vulnerability is tracked as CWE-125 (Out-of-bounds Read). Multiple affected versions across distributions like SUSE and Ubuntu have been identified, and security patches are available.

The vulnerability allows an attacker to cause out-of-bounds memory reads during decompression, potentially disclosing sensitive information such as cryptographic keys, personally identifiable information, or memory layout details that could aid further exploitation. It can also cause a denial of service by crashing the gzip process. The impact is rated medium by the vendor, reflecting the confidentiality and availability concerns but no direct integrity or code execution impact reported.

A security update fixing this vulnerability is available and should be applied. Red Hat and SUSE have released patched versions of gzip addressing CVE-2026-41992. Users should update to the fixed versions provided by their distribution vendors. No additional mitigations are specified or required beyond applying the official patches.