CVE-2026-41991

Name of the Vulnerable Software and Affected Versions GNU gzip (affected versions not specified)

Description The gzexe utility handles temporary files insecurely. If the mktemp utility is missing from the user's PATH, gzexe generates a temporary file path using only the process ID (PID). Because this filename is predictable and created without existence checks or exclusive access, a local attacker can create a symbolic link at that path pointing to any file the victim has permission to write. This creates a time-of-check to time-of-use (TOCTOU) condition—a race condition where a system checks a condition and then uses the result, but the condition changes in between—allowing the attacker to overwrite arbitrary files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.