lrzsz before version 0.13.0 contains a heap buffer overflow in the procheader() function of the lrz receive utility. The overflow occurs when a malicious ZMODEM sender supplies a filename up to 8192 bytes, which is copied into the Pathname buffer using sprintf or strcpy, corrupting heap memory and causing the lrz process to crash. The known impact is a denial of service.

Affected systems include all installations of Uwe Ohse’s lrzsz utility prior to version 0.13.0. Any older release is vulnerable because the fix is introduced in 0.13.0.

The CVSS score of 6.1 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, so current exploitation activity is unknown. The attack vector is inferred to be remote, as a ZMODEM sender can transmit a malicious filename over the network to the lrz program. An attacker with access to the lrz receive process, whether locally or remotely, can trigger the overflow and cause the target to crash.