Executive brief
GNU gzip is a widely used utility for compressing and decompressing files. A security flaw allows an attacker to cause a system crash or potentially read sensitive memory by providing a sequence of specially crafted compressed files. This occurs when the program fails to properly clear its internal memory between processing different file formats in a single command.
Technical details
A buffer over-read (CWE-126) exists in GNU gzip due to the improper reuse of a shared global array across LZ77, LZW, and LZH decompression routines. When multiple files are processed in a single invocation (e.g., 'gzip -d file.Z file.lzh'), the global state is not reinitialized between files. An attacker can provide a specially crafted LZW (.Z) file to poison the shared 'left' and 'right' arrays, followed by a crafted LZH file that triggers an out-of-bounds read in the LZH decoder. This can lead to information disclosure or a crash. The issue is fixed in commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681 by explicitly clearing the affected arrays in unlzh.c.
Affected products
- GNU gzip <= 1.14
Timeline
- 2026-04-15: patched: Fix committed to upstream repository
- 2026-06-29: disclosed: CVE published to NVD