GNU gzip contains a global buffer overflow flaw in its LZH decompression logic due to improper reuse of shared global state between different decompression formats within a single execution. The program maintains a global array shared across LZ77, LZW, and LZH routines and fails to reinitialize it between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip ‑d command, an attacker can poison this shared state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer, which can expose sensitive data without directly enabling code execution.

The flaw affects the GNU gzip command‑line utility on Linux and Unix systems. All releases prior to the patch commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681 are vulnerable; the specific version numbers affected are not enumerated in the advisory but the change is applied in that commit.

The CVSS v3 score of 6.9 reflects a moderate impact. The EPSS score is 0.00364, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or remote, if an attacker can supply a crafted LZW file followed by a crafted LZH file to a gzip process—for instance, through a malicious archive file or a service that decompresses user data. The exploit requires that both files be processed in the same gzip invocation, so the risk is higher in environments that combine multiple files in a single decompression call.