GNU gzip contains a global buffer overflow flaw in its LZH decompression logic. The runtime shares a global array across LZ77, LZW, and LZH paths and fails to reset it between files processed in the same gzip command. By decompressing a crafted LZW file followed by a crafted LZH file in a single execution, an attacker can poison this shared state and trigger an out‑of‑bounds read in the LZH decoder. The vulnerability allows the read of memory beyond the allocated buffer, potentially exposing sensitive data rather than directly enabling code execution.

The flaw affects the GNU gzip command‑line utility on Linux and Unix systems. All releases prior to the patch commit 63dbf6b3b9e6e781df1a6a64e609b10e23969681 are vulnerable; the specific version numbers affected are not enumerated in the advisory but the change is applied in that commit.

The CVSS v3 score of 6.9 reflects a moderate impact. No EPSS score is publicly available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or remote, if an attacker can supply a crafted LZW file followed by a crafted LZH file to a gzip process—for instance, through a malicious archive file or a service that decompresses user data. The exploit requires that both files be processed in the same gzip invocation, so the risk is higher in environments that combine multiple files in a single decompression call.