CVE catalog

CVE-2026-41991

GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temp

[CVE catalog]

Severity
High · CVSS 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.12% · Oct 25, 2026

GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangzipsid1.14-1fixed
Debiangzipforky1.14-1fixed
Debiangziptrixie1.13-1+deb13u1fixed
Debiangzipbookworm1.12-1vulnerable
CpegzipNot reported1.12-1ubuntu3.2fixed
Cpegzip-win32Not reported1.12-1ubuntu3.2fixed
CpegzipNot reportedNot reportedvulnerable
CpegzipNot reportedNot reportedunknown
Ubuntugzippro1.10-0ubuntu3vulnerable
Ubuntugzippro1.10-0ubuntu4vulnerable
Ubuntugzippro1.10-0ubuntu4.1vulnerable
Ubuntugzippro1.10-0ubuntu4.1+esm1fixed
Ubuntugzippro1.10-0ubuntu3vulnerable
Ubuntugzippro1.10-0ubuntu4vulnerable
Ubuntugzippro1.10-0ubuntu4.1vulnerable
Ubuntugzippro1.10-0ubuntu4.1+esm1fixed
Ubuntugzip22.041.10-4ubuntu1vulnerable
Ubuntugzip22.041.10-4ubuntu2vulnerable
Ubuntugzip22.041.10-4ubuntu3vulnerable
Ubuntugzip22.041.10-4ubuntu4vulnerable
Ubuntugzip22.041.10-4ubuntu4.1vulnerable
Ubuntugzip22.041.10-4ubuntu4.2fixed
Ubuntugzip24.041.12-1ubuntu1vulnerable
Ubuntugzip24.041.12-1ubuntu2vulnerable
Ubuntugzip24.041.12-1ubuntu3vulnerable
Ubuntugzip24.041.12-1ubuntu3.1vulnerable
Ubuntugzip24.041.12-1ubuntu3.2fixed
Ubuntugzip25.101.13-1ubuntu3vulnerable
Ubuntugzip25.101.13-1ubuntu4vulnerable
Ubuntugzip26.041.13-1ubuntu4vulnerable
Ubuntugzip26.041.13-1ubuntu5vulnerable
Ubuntugzip26.041.14-1~exp2ubuntu1vulnerable
Ubuntugzip26.041.14-1~exp2ubuntu1.1fixed
Ubuntugzippro1.6-4ubuntu1vulnerable
Ubuntugzippro1.6-4ubuntu1+esm1vulnerable
Ubuntugzippro1.6-4ubuntu1+esm2fixed
Susegziplinux enterprise server 12 sp5-ltss1.10-4.17.1fixed
Susegziplinux enterprise server ltss extended security 12 sp51.10-4.17.1fixed
Susegziplinux micro 6.01.13-2.1fixed
Susegziplinux micro 6.11.13-slfo.1.1_3.1fixed
Susegziplinux enterprise server 16.01.13-160000.3.1fixed
Susegziplinux enterprise server for sap applications 16.01.13-160000.3.1fixed
Susegziplinux enterprise micro 5.31.10-150200.13.1fixed
Susegziplinux enterprise micro 5.41.10-150200.13.1fixed
Susegziplinux enterprise micro 5.51.10-150200.13.1fixed
Susegziplinux enterprise module for basesystem 15 sp71.10-150200.13.1fixed
Susegziplinux enterprise high performance computing 15 sp4-espos1.10-150200.13.1fixed
Susegziplinux enterprise high performance computing 15 sp4-ltss1.10-150200.13.1fixed
Susegziplinux enterprise high performance computing 15 sp5-espos1.10-150200.13.1fixed
Susegziplinux enterprise high performance computing 15 sp5-ltss1.10-150200.13.1fixed
Susegziplinux enterprise server 15 sp4-ltss1.10-150200.13.1fixed
Susegziplinux enterprise server 15 sp5-ltss1.10-150200.13.1fixed
Susegziplinux enterprise server 15 sp6-ltss1.10-150200.13.1fixed
Susegziplinux enterprise server for sap applications 15 sp41.10-150200.13.1fixed
Susegziplinux enterprise server for sap applications 15 sp51.10-150200.13.1fixed
Susegziplinux enterprise server for sap applications 15 sp61.10-150200.13.1fixed
Susegziplinux micro 6.21.13-160000.3.1fixed
Opensusegzipleap 16.01.13-160000.3.1fixed
Ubuntugzip22.041.10-4ubuntu1vulnerable
Ubuntugzip22.041.10-4ubuntu2vulnerable
Ubuntugzip22.041.10-4ubuntu3vulnerable
Ubuntugzip22.041.10-4ubuntu4vulnerable
Ubuntugzip22.041.10-4ubuntu4.1vulnerable
Ubuntugzip22.041.10-4ubuntu4.2fixed
Ubuntugzip24.041.12-1ubuntu1vulnerable
Ubuntugzip24.041.12-1ubuntu2vulnerable
Ubuntugzip24.041.12-1ubuntu3vulnerable
Ubuntugzip24.041.12-1ubuntu3.1vulnerable
Ubuntugzip24.041.12-1ubuntu3.2fixed
Ubuntugzip26.041.13-1ubuntu4vulnerable
Ubuntugzip26.041.13-1ubuntu5vulnerable
Ubuntugzip26.041.14-1~exp2ubuntu1vulnerable
Ubuntugzip26.041.14-1~exp2ubuntu1.1fixed
Opensusegziptumbleweed1.14-2.1fixed
CpegzipNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangzipsourcesid1.14-1not yet assignedNot reported[1141442]
Debiangzipsourceforky1.14-1not yet assignedNot reported[1141442]
Debiangzipsourcetrixie1.13-1+deb13u1not yet assignedNot reported[1141442]
Debiangzipsourcebookworm(unfixed)not yet assignedNot reported[1141442]
CpegzipcpeNot reported1.12-1ubuntu3.2Not reportedNot reportedNot reported
Cpegzip-win32cpeNot reported1.12-1ubuntu3.2Not reportedNot reportedNot reported
Ubuntugzipdebpro1.10-0ubuntu4.1+esm1Not reportedUSN-8733-2Not reported
Ubuntugzipdebpro1.10-0ubuntu4.1+esm1Not reportedUBUNTU-CVE-2026-41991Not reported
Ubuntugzipdeb22.041.10-4ubuntu4.2Not reportedUBUNTU-CVE-2026-41991Not reported
Ubuntugzipdeb24.041.12-1ubuntu3.2Not reportedUBUNTU-CVE-2026-41991Not reported
Ubuntugzipdeb26.041.14-1~exp2ubuntu1.1Not reportedUBUNTU-CVE-2026-41991Not reported
Ubuntugzipdebpro1.6-4ubuntu1+esm2Not reportedUSN-8733-1Not reported
Susegziprpmlinux enterprise server 12 sp5-ltss1.10-4.17.1Not reportedSUSE-SU-2026:3241-1Not reported
Susegziprpmlinux enterprise server ltss extended security 12 sp51.10-4.17.1Not reportedSUSE-SU-2026:3241-1Not reported
Susegziprpmlinux micro 6.01.13-2.1Not reportedSUSE-SU-2026:22918-1Not reported
Susegziprpmlinux micro 6.11.13-slfo.1.1_3.1Not reportedSUSE-SU-2026:22906-1Not reported
Susegziprpmlinux enterprise server 16.01.13-160000.3.1Not reportedSUSE-SU-2026:22818-1Not reported
Susegziprpmlinux enterprise server for sap applications 16.01.13-160000.3.1Not reportedSUSE-SU-2026:22818-1Not reported
Susegziprpmlinux enterprise micro 5.31.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise micro 5.41.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise micro 5.51.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise module for basesystem 15 sp71.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise high performance computing 15 sp4-espos1.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise high performance computing 15 sp4-ltss1.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise high performance computing 15 sp5-espos1.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise high performance computing 15 sp5-ltss1.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise server 15 sp4-ltss1.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise server 15 sp5-ltss1.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise server 15 sp6-ltss1.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise server for sap applications 15 sp41.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise server for sap applications 15 sp51.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux enterprise server for sap applications 15 sp61.10-150200.13.1Not reportedSUSE-SU-2026:3269-1Not reported
Susegziprpmlinux micro 6.21.13-160000.3.1Not reportedSUSE-SU-2026:22753-1Not reported
Opensusegziprpmleap 16.01.13-160000.3.1Not reportedOPENSUSE-SU-2026:21371-1Not reported
Ubuntugzipdeb22.041.10-4ubuntu4.2Not reportedUSN-8512-1Not reported
Ubuntugzipdeb24.041.12-1ubuntu3.2Not reportedUSN-8512-1Not reported
Ubuntugzipdeb26.041.14-1~exp2ubuntu1.1Not reportedUSN-8512-1Not reported
Opensusegziprpmtumbleweed1.14-2.1Not reportedOPENSUSE-SU-2026:11174-1Not reported

[Debian bug #1141442]

Notes

[bookworm] gzip: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gzip]Affected
    Details (2)

    • 1.12-1 · amd64 · bookworm

      Affected

      nvd · gzip · debian · bookworm; nvd · gzip · debian · 12

    • 1.12-1 · arm64 · bookworm

      Affected

      nvd · gzip · debian · bookworm; nvd · gzip · debian · 12

  • [gzip-win32]Affected

    Source package: [gzip]

    Details (2)

    • 1.12-1 · all · bookworm

      Affected

      nvd · gzip · debian · bookworm; nvd · gzip · debian · 12

    • 1.12-1 · all · bookworm

      Affected

      nvd · gzip · debian · bookworm; nvd · gzip · debian · 12

[Debian 13 (Trixie)]

  • [gzip]Affected
    Details (2)

    • 1.13-1 · amd64 · trixie

      Affected · Fixed: 1.13-1+deb13u1

      nvd · gzip · debian · 13

    • 1.13-1 · arm64 · trixie

      Affected · Fixed: 1.13-1+deb13u1

      nvd · gzip · debian · 13

[openSUSE Tumbleweed]

  • [gzip]Fixed

    Source package: [gzip]

    Details (1)

    • 1.14-3.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.14-2.1

      nvd · gzip · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]