Heap-Based Buffer Overflow in lrzsz Receive Utility from Open Source Vendor

CVE-2026-105842

What is CVE-2026-105842?

The lrzsz receive utility, used for transferring files, is vulnerable to a heap-based buffer overflow in the procheader() function. This vulnerability arises when it attempts to process overly long filenames supplied by a malicious sender, allowing filenames of up to 8192 bytes to corrupt heap memory. Exploitation of this flaw can lead to application crashes and potential unauthorized manipulation of system memory. Users are recommended to upgrade to version 0.13.0 or later to mitigate this risk.

References