GNU Gzip vulnerabilities

13 CVEs affecting GNU Gzip, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-41992, published 2026-06-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-1271, published 2022-08-31. High severity, CVSS 8.8. EPSS: 5.2% chance of exploitation in the next 30 days. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an…
CVE-2010-0001, published 2010-01-29. Medium severity, CVSS 6.8. EPSS: 4.8% chance of exploitation in the next 30 days. Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application…
CVE-2009-2624, published 2010-01-29. Medium severity, CVSS 6.8. EPSS: 4.2% chance of exploitation in the next 30 days. The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or…
CVE-2005-1228, published 2005-05-02. Medium severity, CVSS 5.0. EPSS: 3.6% chance of exploitation in the next 30 days. Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed…
CVE-2004-0603, published 2004-12-06. High severity, CVSS 10.0. EPSS: 3.1% chance of exploitation in the next 30 days. gzexe in gzip 1.3.3 and earlier will execute an argument when the creation of a temp file fails instead of exiting the program, which could allow remote attackers or local users to execute arbitrary…
CVE-2001-1228, published 2001-11-18. High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days. Buffer overflows in gzip 1.3x, 1.2.4, and other versions might allow attackers to execute code via a long file name, possibly remotely if gzip is run on an FTP server.
CVE-2005-0988, published 2005-05-02. Low severity, CVSS 3.7. EPSS: 0.7% chance of exploitation in the next 30 days. Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being…
CVE-2026-41992, published 2026-06-29. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single…
CVE-2004-1349, published 2004-10-04. Low severity, CVSS 2.1. EPSS: 0.6% chance of exploitation in the next 30 days. gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these…
CVE-2005-0758, published 2005-05-13. Medium severity, CVSS 4.6. EPSS: 0.5% chance of exploitation in the next 30 days. zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.

Latest

CVE-2026-41991, published 2026-06-29. Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days. GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a…
CVE-2004-0970, published 2005-02-09. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. The (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package, as used by other packages such as ncompress, allows local users to overwrite files via a symlink attack on temporary files. NOTE:…