CVE-2026-105842
lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz…
- Risk score
- 40/100
- CVSS
- 6.4 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.13.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.4 medium
References
Original description
lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.
Last activity 6 Oct 2026. Patch Forecast updates every hour.