Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.9

lrzsz receive utility may crash with long filenames

CVE-2026-105842 · published 29 days ago
Summary

The lrzsz program used for ZMODEM file transfers can be forced to stop working if a sender provides a filename that is unusually long. This happens because the program does not correctly limit the size of the name it stores, leading to memory corruption and a crash. Upgrade lrzsz to version 0.13.0 or newer to protect against this issue.

What to do
  • Update debian lrzsz to version 0.12.21rc-5.
  • Update uwe ohse lrzsz to version 0.13.0 or later.
Affected software
Ecosystem VendorProductAffected versions
– uwe ohse lrzsz < 0.13.0
Debian:12 debian lrzsz All versions
Ubuntu:14.04:LTS canonical lrzsz All versions
Debian:14 debian lrzsz < 0.12.21rc-5
Fix: upgrade to 0.12.21rc-5
Original advisory text
DEBIAN-CVE-2026-105842
lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.9 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published6 Oct 2026
Updated29 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-105842 · NVD
CVE-2026-105842 · MITRE
DEBIAN-CVE-2026-105842 · OSV
UBUNTU-CVE-2026-105842 · OSV
Track software like this
Free during beta