Threat database

A heap-based buffer overflow vulnerability exists in lrzsz versions before 0.13.0 in the procheader() function of the lrz receive utility. This occurs when overlong sender-supplied filenames (up to 8192 bytes) are copied into a fixed-size buffer, leading to heap memory corruption and potential crashes. The flaw arises from unsafe use of sprintf() or strcpy() in pipe mode. The vulnerability has a medium severity score of 6.1 and requires user interaction for exploitation.

CVE-2026-105841 is an OS command injection vulnerability in lrzsz before version 0.13.0. The flaw exists in the lrz receive utility's pipe mode when run under suffixed names like lrztar. It allows remote senders to execute arbitrary commands by supplying crafted filenames that are passed unescaped to popen(). This vulnerability has a high severity rating with a CVSS score of 7.7.

CVE-2026-105840 is a path traversal vulnerability in the lrzsz utility before version 0.13.0. It affects the lrz receive utility's restricted mode, allowing attackers to write files outside the current directory by using absolute pathnames. The vulnerability arises because the pathname check only rejects '../' sequences unless built with a specific option, enabling malicious ZMODEM senders to overwrite any file writable by the receiving user.