GNU gzip’s gzexe utility uses an insecure method for creating temporary files when the mktemp tool is not found in the system’s PATH: it constructs a file name solely from the current process ID without any exclusive access or existence verification. An attacker who can run commands locally may therefore create a symbolic link at the predicted file name pointing to any file that the victim can write. When gzexe executes, it follows the symlink and overwrites the target file, demonstrating a time‑of‑check to time‑of‑use (TOCTOU) flaw that permits arbitrary file modification. The impact is that confidential or configuration files can be overwritten, potentially facilitating further compromise or denial of service, but the vulnerability requires the attacker to have local execution privileges and the ability to create symbolic links.

All installations of GNU gzip that include the gzexe utility and do not contain the patch commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 are affected. This includes older versions of gzip across Linux, Unix, and other operating systems where the gzexe command is present.

The CVSS score of 2 indicates low severity, and the EPSS score is not available, suggesting no publicly known exploits at this time. The vulnerability is not listed in CISA’s KEV catalogue, further indicating a low likelihood of widespread exploitation. However, because the attack requires only local access and the ability to create a symbolic link, it is easily exploitable on systems where users have such permissions. The exploit path is straightforward: set up a malicious symlink to a writable target, then run gzexe; the file is overwritten. The risk is mitigated primarily by patching or otherwise preventing access to the vulnerable utility.