CVE-2026-105842

Name of the Vulnerable Software and Affected Versions lrzsz versions prior to 0.13.0

Description A heap-based buffer overflow occurs in the procheader() function of the lrz receive utility. This issue arises when the utility copies excessively long filenames provided by a sender into the Pathname variable. A malicious ZMODEM sender can provide filenames up to 8192 bytes, causing a buffer overflow via sprintf() in pipe mode or strcpy(), which leads to heap memory corruption and application crashes.

Recommendations Update lrzsz to version 0.13.0 or later.