CVE-2026-41991
published 2026-06-29CVE-2026-41991: GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s…
PriorityP425medium4.7CVSS 3.1
AVLACHPRLUINSUCNIHAN
EPSS
0.10%
1.3th percentile
GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.
A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.
This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | code-sshd-rhel9 | — | — |
| gnu | gzip | <= 1.14 | — |
| gzip | gzip | — | — |
| ubuntu | gzip | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv4.02.0LOWCVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_ubuntu4.7MEDIUM
vendor_redhat2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Gzip vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 4.7
CVE-2026-41992 [MEDIUM] Gzip vulnerabilities
Title: Gzip vulnerabilities
Summary: Several security issues were fixed in Gzip.
It was discovered that Gzip's gzexe utility handled temporary files in an
insecure manner. When the mktemp utility was not available, gzexe
constructed a temporary file path based on the process ID, which could be
predicted. A local attacker could possibly use this issue to overwrite
arbitrary files via a symlink attack. (CVE-2026-41991)
It was discovered that Gzip incorrectly handled certain compressed files.
An attacker could possibly use this issue to obtain sensitive information
or cause Gzip to crash, resulting in a denial of service. (CVE-2026-41992)
Instructions: In general, a standard system update will make all the necessary
changes.
Red Hat
gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility
vendor_redhat·2026-06-29·CVSS 2.0
CVE-2026-41991 [LOW] CWE-59 gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility
gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility
A flaw was found in the `gzexe` utility of GNU `gzip`. When the `mktemp` utility is not available, `gzexe` creates temporary files with predictable names based on the process ID. A local attacker can exploit this by pre-creating a symbolic link to an arbitrary file at the predicted temporary file path. This can lead to a Time-of-Check to Time-of-Use (TOCTOU) condition, allowing the attacker to overwrite arbitrary files on the system.
Statement: A flaw was found in the gzexe utility of GNU gzip. When the mktemp utility is not available in the user's PATH, gzexe creates temporary files with predictable names based on the process ID. A local attacker can exploit this by creating a symbolic link at the
VulDB
GNU gzip up to 1.14 Gzexe Utility temp file (EUVD-2026-40068 / Nessus ID 325426)
vuldb·2026-07-08·CVSS 4.7
CVE-2026-41991 [MEDIUM] GNU gzip up to 1.14 Gzexe Utility temp file (EUVD-2026-40068 / Nessus ID 325426)
A vulnerability described as problematic has been identified in GNU gzip up to 1.14. Impacted is an unknown function of the component Gzexe Utility. The manipulation results in insecure temporary file.
This vulnerability is known as CVE-2026-41991. Attacking locally is a requirement. No exploit is available.
A patch should be applied to remediate this issue.
GHSA
GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling.
ghsa_unreviewed·2026-06-29
CVE-2026-41991 [LOW] CWE-377 GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling.
GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.
A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.
This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-41991 gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility [fedora-all]
bugzilla·2026-06-29·CVSS 2.0
CVE-2026-41991 [LOW] CVE-2026-41991 gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility [fedora-all]
CVE-2026-41991 gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.
A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file wri
Bugzilla
CVE-2026-41991 gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility
bugzilla·2026-06-29·CVSS 2.0
CVE-2026-41991 [LOW] CVE-2026-41991 gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility
CVE-2026-41991 gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility
GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.
A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.
This issue has been fixed in the commit 4e6
2026-06-29
Published