Description
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Uwe Ohse | lrzsz | < 0.13.0 | 0.13.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lrzsz | 0.13.1-1 | — |
| Debian 13 | lrzsz | No fix yet | — |
| Debian 12 | lrzsz | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | lrzsz | No fix yet | — |
| Ubuntu 26.04 LTS | lrzsz | No fix yet | — |
| Ubuntu 24.04 LTS | lrzsz | No fix yet | — |
| Ubuntu 22.04 LTS | lrzsz | No fix yet | — |
| Ubuntu 20.04 LTS | lrzsz | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | lrzsz | No fix yet | — |
| Ubuntu 16.04 LTS | lrzsz | No fix yet | — |
| Ubuntu 14.04 LTS | lrzsz | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | lrzsz | 0.12.20-68.el10_3 | RHSA-2026:98585, RHSA-2026:86056 |
| RHEL 9 | lrzsz | 0.12.20-58.el9_8 | RHSA-2026:98481, RHSA-2026:89755 |
| RHEL 8 | lrzsz | 0.12.20-46.el8_10 | RHSA-2026:83525 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | lrzsz | 0.12.20-69.el10_2 | ALSA-2026:86056 |
| AlmaLinux 9 | lrzsz | 0.12.20-58.el9_8 | ALSA-2026:89755 |
| AlmaLinux 8 | lrzsz | 0.12.20-46.el8_10 | ALSA-2026:83525 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | lrzsz | 0.12.20-69.el10_2 | RLSA-2026:86056 |
| Rocky Linux 9 | lrzsz | 0.12.20-58.el9_8 | RLSA-2026:98481, RLSA-2026:89755 |
| Rocky Linux 8 | lrzsz | 0.12.20-46.el8_10 | RLSA-2026:83525 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | lrzsz | 0.12.20-36.amzn2.0.3 | ALAS2-2026-4031 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | lrzsz | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | lrzsz | 0.12.20-69.el10_2 | ELSA-2026-86056 |
| Oracle Linux 9 | lrzsz | 0.12.20-58.el9_8 | ELSA-2026-89755 |
| Oracle Linux 8 | lrzsz | 0.12.20-46.el8_10 | ELSA-2026-83525 |
Advisories 17
- RHSA-2026:98585 Red Hat Security Advisory: lrzsz security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98481 Red Hat Security Advisory: lrzsz security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:89755 Red Hat Security Advisory: lrzsz security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:86056 Red Hat Security Advisory: lrzsz security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98481 Important: lrzsz security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 12, 2026
- WID-SEC-2026-3978 Red Hat Enterprise Linux (lrzsz): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- ALSA-2026:89755 Important: lrzsz security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:86056 Important: lrzsz security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:83525 Important: lrzsz security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:89755 Important: lrzsz security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 27, 2026
- ALAS2-2026-4031 Important: lrzsz security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ELSA-2026-89755 Important: lrzsz security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 26, 2026
- RLSA-2026:86056 Important: lrzsz security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 22, 2026
- ELSA-2026-86056 Important: lrzsz security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 20, 2026
- RLSA-2026:83525 Important: lrzsz security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 16, 2026
- RHSA-2026:83525 Red Hat Security Advisory: lrzsz security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- ELSA-2026-83525 Important: lrzsz security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 15, 2026
References
- lrzsz 0.13.0 security changes vendor-advisory
- https://ohse.de/uwe/software/lrzsz.html product
- VulnCheck Advisory: lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode third-party-advisory