Log in Start free

Vulnerability · Published Oct 6, 2026 · Assigned by VulnCheck

CVE-2026-105841lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode

High 7.5

In plain English

A high-severity OS command injection in lrzsz from Uwe Ohse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 39.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10lrzsz0.12.20-69.el10_2ALSA-2026:86056
AlmaLinux:8lrzsz0.12.20-46.el8_10ALSA-2026:83525
AlmaLinux:9lrzsz0.12.20-58.el9_8ALSA-2026:89755
Debian:12lrzszno fix listedDEBIAN-CVE-2026-105841
Debian:13lrzszno fix listedDEBIAN-CVE-2026-105841
Debian:14lrzsz0.13.1-1DEBIAN-CVE-2026-105841
Rocky Linux:10lrzsz0:0.12.20-69.el10_2RLSA-2026:86056
Rocky Linux:8lrzsz0:0.12.20-46.el8_10RLSA-2026:83525
Rocky Linux:9lrzsz0:0.12.20-58.el9_8RLSA-2026:89755
Ubuntu:22.04:LTSlrzszno fix listedUBUNTU-CVE-2026-105841
Ubuntu:24.04:LTSlrzszno fix listedUBUNTU-CVE-2026-105841
Ubuntu:26.04:LTSlrzszno fix listedUBUNTU-CVE-2026-105841
Ubuntu:26.10lrzszno fix listedUBUNTU-CVE-2026-105841

Affected products (as reported)

VendorProductVersions
Uwe Ohse lrzsz 0 – before 0.13.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References