CVE-2026-105842

A flaw was found in lrzsz. A remote attacker acting as a malicious sender can trigger a heap-based buffer overflow by providing an excessively long filename during a ZMODEM file transfer. This flaw allows the attacker to corrupt memory and crash the application, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because successful exploitation requires explicit user interaction to establish a file transfer with an untrusted party. The affected utility is an on-demand command-line tool rather than a persistent background service, significantly limiting exposure in standard deployments. Any potential impact is confined to the privileges of the local user executing the receive program, primarily resulting in process termination.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.