VDB
RHSA-2026:61623
RHSA-2026:61623
PUBLISHED
CVSS 3.5999999046325684 LOW
Record from redhat · Published August 31, 2026
A flaw was found in the `gzexe` utility of GNU `gzip`. When the `mktemp` utility is not available, `gzexe` creates temporary files with predictable names based on the process ID. A local attacker can exploit this by pre-creating a symbolic link to an arbitrary file at the predicted temporary file path. This can lead to a Time-of-Check to Time-of-Use (TOCTOU) condition, allowing the attacker to overwrite arbitrary files on the system.
Risk scores
CVSS 3.1
3.5999999046325684
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | gzip-debuginfo-0:1.12-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
| Red Hat | gzip-debuginfo-0:1.12-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
| Red Hat | gzip-0:1.12-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
| Red Hat | gzip-debuginfo-0:1.12-2.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
| Red Hat | gzip-0:1.12-2.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
| Red Hat | gzip-0:1.12-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
| Red Hat | gzip-debugsource-0:1.12-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
| Red Hat | gzip-debugsource-0:1.12-2.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
| Red Hat | gzip-debuginfo-0:1.12-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
| Red Hat | gzip-debugsource-0:1.12-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
| Red Hat | gzip-0:1.12-2.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
| Red Hat | gzip-debugsource-0:1.12-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
| Red Hat | gzip-0:1.12-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9) | 0:1.12-2.el9_8 |
Timeline
- Aug 31, 2026 CVE Published
- Sep 1, 2026 CVE Updated
- Sep 1, 2026 Distribution Patch (2 in total, the first dated here)
- Sep 1, 2026 Security Advisory (3 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln RHSA-2026:61623
vulnetix vdb fixes RHSA-2026:61623Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%3A61623/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://access.redhat.com/errata/RHSA-2026:61623 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2494158 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61623.json advisory
- https://access.redhat.com/security/cve/CVE-2026-41991 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-41991 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41991 advisory
- https://cert.pl/en/posts/2026/04/CVE-2026-41991/ advisory
- https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269 advisory
- https://www.gnu.org/software/gzip/ advisory
- https://access.redhat.com/security/cve/CVE-2026-41992 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2494159 issue
- https://www.cve.org/CVERecord?id=CVE-2026-41992 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41992 advisory
- https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681 advisory