CVE-2026-105842

MediumCVSS 6.4/10Last modified Oct 6, 2026

Description

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published
Oct 6, 2026
Last modified
Oct 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1058449.3Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-CVE-2026-1058459.8Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-CVE-2026-1058466.1Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0CVE-2026-1058476.5Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-CVE-2026-1058489.6Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versionCVE-2026-1058498.3Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-CVE-2026-105855.4A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbCVE-2026-1058508.2Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versCVE-2026-1058518.1Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-CVE-2026-1058527.5Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, CVE-2026-1058536.5Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-CVE-2026-1058547.5Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-
CVE-2026-105842: Medium severity, CVSS 6.4 | Vulnix