Insecure Temporary File Handling in GNU Gzip's Gzexe Utility

CVE-2026-41991

What is CVE-2026-41991?

The gzexe utility in GNU gzip is susceptible to a vulnerability stemming from insecure handling of temporary files. When the mktemp utility is absent from the user’s PATH, gzexe resorts to generating a temporary file path using just the process ID (PID). This predictable filename does not incorporate exclusive access or existence validation, which permits a local attacker to preemptively create a symbolic link at the anticipated temporary file location. When gzexe operates, it may follow this symbolic link, inadvertently overwriting a different file that the attacker has targeted. This flaw results in a time-of-check to time-of-use (TOCTOU) condition, ultimately enabling unauthorized file overwrite attacks. This issue has been rectified in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269.

References