CVE-2026-41992

Name of the Vulnerable Software and Affected Versions GNU gzip (affected versions not specified)

Description An issue exists in the LZH decompression logic where shared global state is improperly reused between different decompression formats during a single execution. The software maintains a global array shared across LZ77, LZW, and LZH routines that is not reinitialized between processed files. An attacker can poison this shared state by decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single command, triggering an out-of-bounds read in the LZH decoder as it follows stale values left in the shared array.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.