Hi,

The following vulnerability was published for gzip.

CVE-2026-41992[0]:
| GNU gzip contains a global buffer overflow vulnerability in the LZH
| decompression logic caused by improper reuse of shared global state
| between different decompression formats within a single execution.
| GNU gzip maintains a global array that is shared across the LZ77,
| LZW, and LZH decompression routines and is not reinitialized between
| files processed in the same invocation. By decompressing a specially
| crafted LZW file followed by a specially crafted LZH file in a
| single gzip -d command, an attacker can poison the shared global
| state and subsequently trigger an out‑of‑bounds read in the LZH
| decoder. The LZH decompression logic follows stale values left in
| the shared array, causing reads past the end of the allocated global
| buffer.  This issue has been fixed in the commit
| 63dbf6b3b9e6e781df1a6a64e609b10e23969681


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-41992
https://www.cve.org/CVERecord?id=CVE-2026-41992
[1] https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
gzip, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1141443@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Milan Kupcevic <milan@debian.org> (supplier of updated gzip package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 16 Aug 2026 21:14:53 -0400
Source: gzip
Architecture: source
Version: 1.14-1
Distribution: sid
Urgency: medium
Maintainer: Milan Kupcevic <milan@debian.org>
Changed-By: Milan Kupcevic <milan@debian.org>
Closes: 513754 1137242 1141442 1141443
Changes:
 gzip (1.14-1) sid; urgency=medium
 .
   [ Milan Kupcevic ]
   * new upstream release
     - gzexe, zdiff, zgrep: Switch scripts from using `type` to
     `command -v` to support non-XSI, closes: #513754
   * cherry-pick upstream uninitialized read fix
   * d/p/CVE-2026-41991-a.patch, d/p/CVE-2026-41991-b.patch: use -C if
     lacking mktemp, closes: #1141442, CVE-2026-41991
   * d/p/CVE-2026-41992.patch: gzip: don’t mishandle .lzh after .Z,
     closes: #1141443, CVE-2026-41992
   * d/control: comply to standards version 4.7.4
 .
   [ Grayson Wolf ]
   * add more complex autopkgtest scripts, closes: #1137242
 .
 gzip (1.14-1~exp2) experimental; urgency=medium
 .
   * d/rules: configure set /bin/sh and grep; autoreconf cleanup
 .
 gzip (1.14-1~exp1) experimental; urgency=medium
 .
   * new upstream release
 .
 gzip (1.13.56~e549-1~exp1) experimental; urgency=medium
 .
   * new upstream release
   * d/patches: quilt refresh
   * d/copyright: update
   * d/rules: use debhelper leverage
   * d/control: comply to standards version 4.7.2
   * d/patches/disable-Werror.patch: drop
Checksums-Sha1:
 069e4182547a4721f4c6493ed681fea29c98ba99 1908 gzip_1.14-1.dsc
 2c4407eec3693261616b7e93524d82a187222104 22540 gzip_1.14-1.debian.tar.xz
 c316bb9a31481b986622d589da16a910b8e4836c 5983 gzip_1.14-1_amd64.buildinfo
Checksums-Sha256:
 8c02e8f12a2f9f45db2fe4de1a65900f47311c2d1e49f839b00172d9c420ef03 1908 gzip_1.14-1.dsc
 f3e0edcb4092dbcf62ff0b7ac068fddb4ba7b644c55edf005b25415f9d9ce628 22540 gzip_1.14-1.debian.tar.xz
 7343425201cca344aa5396dac2b3f37bb1aa0f8e0e59fc2547703b7f483e34ca 5983 gzip_1.14-1_amd64.buildinfo
Files:
 516cc7357bbd0bcfd3134417dd261c7b 1908 utils required gzip_1.14-1.dsc
 66c7b0b60b823b3b6cde7abb662e5e02 22540 utils required gzip_1.14-1.debian.tar.xz
 fe885667f28ef226379927544a740d24 5983 utils required gzip_1.14-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQHFBAEBCgAvFiEEVkf/m69krCYf+z+G6e1ngbRVCQ4FAmqCbvoRHG1pbGFuQGRl
Ymlhbi5vcmcACgkQ6e1ngbRVCQ56DgwAyGcHYaF1vUAC9oZm4jo4QIOgpfhk/CXS
Ie32KgRKuuHKQy/pRvEvi6V0cOvUO6rqm5qozz11zJsrotrTzJoPcpNDdYQgCaik
tts5rCqiCOQ16RbjLPj/8ATaWzMQwciLpKgv+PbaNVXeph6eSMfuK8MporIYTSpb
FqLn6WElBFU5XjwLfM27qjO/UBeLfP3FmKEH6R7KxxO6eOi+35qcu0MKMYs+3bSE
zDDDwtXuSoviQpKM+P0XgaspTYM4nt1uynm41LHQu12UXi40bcafDBvXnFrRLkpT
pDkpvd+7SZxhIFxjyqw5dK9qsm2XjnTDyyqY7WrDZRbmpmgoQysKmVU5d+P/CEFJ
EaonVh/dsYmU42YWQ5al9XcQodlQes1/vGYe1F8X99y7IovXlPwI2dfxwVXA6m84
4uh+pQKituqIIsJ6wdhsEY/BD9B95oED2TkV+J48wTXVI+69uxKM0uN3+pGCiXjK
F78M4k+S2YyULOiu/pE3EB/ZC04LHpCo
=aewa
-----END PGP SIGNATURE-----