Vulnerability · Published Jun 29, 2026 · Assigned by CERT-PL
CVE-2026-41991Predictable Temporary File in GNU gzip
Low 2.0
In plain English
A low-severity security flaw in gzip from GNU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | gzip | 1.13-4.el10_2 | ALSA-2026:61625 |
| AlmaLinux:8 | gzip | 1.9-15.el8_10 | ALSA-2026:65998 |
| AlmaLinux:9 | gzip | 1.12-2.el9_8 | ALSA-2026:61623 |
| Alpine:v3.24 | gzip | 1.15-r0 | ALPINE-CVE-2026-41991 |
| Debian:12 | gzip | no fix listed | DEBIAN-CVE-2026-41991 |
| Debian:13 | gzip | 1.13-1+deb13u1 | DEBIAN-CVE-2026-41991 |
| Debian:14 | gzip | 1.14-1 | DEBIAN-CVE-2026-41991 |
| Rocky Linux:10 | gzip | 0:1.13-4.el10_2 | RLSA-2026:61625 |
| Rocky Linux:8 | gzip | 0:1.9-15.el8_10 | RLSA-2026:65998 |
| Rocky Linux:9 | gzip | 0:1.12-2.el9_8 | RLSA-2026:61623 |
| Ubuntu:22.04:LTS | gzip | 1.10-4ubuntu4.2 | USN-8512-1 |
| Ubuntu:22.04:LTS | gzip | 1.10-4ubuntu4.2 | UBUNTU-CVE-2026-41991 |
| Ubuntu:24.04:LTS | gzip | 1.12-1ubuntu3.2 | UBUNTU-CVE-2026-41991 |
| Ubuntu:24.04:LTS | gzip | 1.12-1ubuntu3.2 | USN-8512-1 |
| Ubuntu:25.10 | gzip | no fix listed | UBUNTU-CVE-2026-41991 |
| Ubuntu:26.04:LTS | gzip | 1.14-1~exp2ubuntu1.1 | UBUNTU-CVE-2026-41991 |
| Ubuntu:26.04:LTS | gzip | 1.14-1~exp2ubuntu1.1 | USN-8512-1 |
Affected products (as reported)
Weakness: CWE-377 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N