CVE-2026-105842: medium-severity vulnerability in Uwe Ohse lrzsz
lrzsz before 0.13.0 Heap Buffer Overflow via lrz procheader() Pathname
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.2%
exploitation probability
0.2%top 90% of all CVEs
observed exploitation
nono source reports it
lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Affected products
Uwe Ohse · lrzszRelated CVEs — Uwe Ohse lrzsz
In the same product, most dangerous first.