CVE-2026-105842 lrzsz before 0.13.0 Heap Buffer Overflow via lrz procheader() Pathname
A heap buffer overflow in lrzsz allows malicious ZMODEM senders to crash the application or potentially execute code via overlong filenames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-105842?
CVE-2026-105842 is a medium-severity memory corruption vulnerability in Uwe Ohse lrzsz, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.
Weakness: CWE-122
Which versions are affected by CVE-2026-105842?
How do I fix CVE-2026-105842?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-105842 being exploited?
There is no known exploitation of CVE-2026-105842 in the wild and no public exploit code.
Sources
Also known as AZL-106670, DEBIAN-CVE-2026-105842, GHSA-3cw3-cf87-8pwp, UBUNTU-CVE-2026-105842.