Description
GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks.
A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.
This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNU | gzip | ≤ 1.14 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gzip | 1.14-1 | — |
| Debian 13 | gzip | 1.13-1+deb13u1 | — |
| Debian 12 | gzip | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | gzip | 1.14-1~exp2ubuntu1.1 | USN-8512-1 |
| Ubuntu 25.10 | gzip | No fix yet | — |
| Ubuntu 24.04 LTS | gzip | 1.12-1ubuntu3.2 | USN-8512-1 |
| Ubuntu 22.04 LTS | gzip | 1.10-4ubuntu4.2 | USN-8512-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | gzip | 1.10-0ubuntu4.1+esm1 | USN-8733-2 |
| Ubuntu Pro 18.04 LTS | gzip | 1.6-5ubuntu1.2+esm1 | USN-8733-2 |
| Ubuntu Pro 16.04 LTS | gzip | 1.6-4ubuntu1+esm2 | USN-8733-1 |
| Ubuntu Pro 14.04 LTS | gzip | 1.6-3ubuntu1+esm2 | USN-8733-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gzip | 1.13-4.el10_2 | RHSA-2026:61625 |
| RHEL 9 | gzip | 1.12-2.el9_8 | RHSA-2026:61623 |
| RHEL 8 | gzip | 1.9-15.el8_10 | RHSA-2026:65998 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | gzip | 1.14-2.2.hum1 | RHSA-2026:79717, RHSA-2026:33771 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gzip | 1.13-4.el10_2 | ALSA-2026:61625 |
| AlmaLinux 9 | gzip | 1.12-2.el9_8 | ALSA-2026:61623 |
| AlmaLinux 8 | gzip | 1.9-15.el8_10 | ALSA-2026:65998 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gzip | 1.13-4.el10_2 | RLSA-2026:61625 |
| Rocky Linux 9 | gzip | 1.12-2.el9_8 | RLSA-2026:61623 |
| Rocky Linux 8 | gzip | 1.9-15.el8_10 | RLSA-2026:65998 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | gzip | 1.10-150200.13.1 | SUSE-SU-2026:3269-1 |
| SLES 15 SP6 | gzip | 1.10-150200.13.1 | SUSE-SU-2026:3269-1 |
| SLES 15 SP5 | gzip | 1.10-150200.13.1 | SUSE-SU-2026:3269-1 |
| SLES 15 SP4 | gzip | 1.10-150200.13.1 | SUSE-SU-2026:3269-1 |
| SLES 12 SP5 | gzip | 1.10-4.17.1 | SUSE-SU-2026:3241-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | gzip | 1.13-160000.3.1 | SUSE-SU-2026:22818-1 |
| SLES for SAP 15 SP6 | gzip | 1.10-150200.13.1 | SUSE-SU-2026:3269-1 |
| SLES for SAP 15 SP5 | gzip | 1.10-150200.13.1 | SUSE-SU-2026:3269-1 |
| SLES for SAP 15 SP4 | gzip | 1.10-150200.13.1 | SUSE-SU-2026:3269-1 |
| SLES 16.0 | gzip | 1.13-160000.3.1 | SUSE-SU-2026:22818-1 |
| SLE Micro 6.2 | gzip | 1.13-160000.3.1 | SUSE-SU-2026:22753-1 |
| SLE Micro 6.1 | gzip | 1.13-slfo.1.1_3.1 | SUSE-SU-2026:22906-1 |
| SLE Micro 6.0 | gzip | 1.13-2.1 | SUSE-SU-2026:22918-1 |
| SLE Micro 5.5 | gzip | 1.10-150200.13.1 | SUSE-SU-2026:3269-1 |
| SLE Micro 5.4 | gzip | 1.10-150200.13.1 | SUSE-SU-2026:3269-1 |
| SLE Micro 5.3 | gzip | 1.10-150200.13.1 | SUSE-SU-2026:3269-1 |
| SLE HPC 15 SP5 | gzip | 1.10-150200.13.1 | SUSE-SU-2026:3269-1 |
| SLE HPC 15 SP4 | gzip | 1.10-150200.13.1 | SUSE-SU-2026:3269-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gzip | 1.14-2.1 | openSUSE-SU-2026:11174-1 |
| openSUSE Leap 16.0 | gzip | 1.13-160000.3.1 | openSUSE-SU-2026:21371-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | gzip | 1.15-r0 | — |
Advisories 23
- ALSA-2026:61623 Moderate: gzip security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:61625 Moderate: gzip security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:65998 Moderate: gzip security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2126 gzip: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026
- RHSA-2026:79717 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:65998 Red Hat Security Advisory: gzip security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:61625 Red Hat Security Advisory: gzip security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:61623 Red Hat Security Advisory: gzip security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:33771 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- USN-8733-2 gzip vulnerabilities Ubuntu Security Notices (USN) · Sep 23, 2026
- RLSA-2026:65998 Moderate: gzip security update Rocky Linux Security Advisories · Sep 10, 2026
- USN-8733-1 gzip vulnerabilities Ubuntu Security Notices (USN) · Sep 8, 2026
- RLSA-2026:61625 Moderate: gzip security update Rocky Linux Security Advisories · Sep 1, 2026
- RLSA-2026:61623 Moderate: gzip security update Rocky Linux Security Advisories · Sep 1, 2026
- SUSE-SU-2026:3241-1 Security update for gzip SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22918-1 Security update for gzip SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22906-1 Security update for gzip SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22818-1 Security update for gzip SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:3269-1 Security update for gzip SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22753-1 Security update for gzip SUSE / openSUSE Security Updates · Jul 23, 2026
- openSUSE-SU-2026:21371-1 Security update for gzip SUSE / openSUSE Security Updates · Jul 22, 2026
- USN-8512-1 gzip vulnerabilities Ubuntu Security Notices (USN) · Jul 6, 2026
- openSUSE-SU-2026:11174-1 gzip-1.14-2.1 on GA media SUSE / openSUSE Security Updates · Jul 3, 2026