---
id: CVE-2026-105841
title: >-
  lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz
  receive utility's pipe mode that allows remote senders to execute commands by
  supplying crafted filenames
summary: >-
  lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz
  receive utility's pipe mode that allows remote senders to execute commands by
  supplying crafted filenames. When lrz runs under a suffixed name such as
  lrztar, …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: Uwe Ohse
product: lrzsz
affected:
  - lrzsz < 0.13.0
published: '2026-10-06'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T15:25:00.650'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105841'
references:
  - url: 'https://ohse.de/uwe/software/lrzsz.html'
    label: disclosure@vulncheck.com
  - url: 'https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-os-command-injection-via-lrz-pipe-mode
    label: disclosure@vulncheck.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105841.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-105841'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2546595'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-105841'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105841'
  - url: 'https://access.redhat.com/errata/RHSA-2026:83525'
  - url: 'https://access.redhat.com/errata/RHSA-2026:86056'
  - url: 'https://access.redhat.com/errata/RHSA-2026:89755'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-06T13:56:33.353808Z'
ingestedAt: '2026-10-06T14:00:19.148Z'
epss: 0.00935
epssPercentile: 0.60601
patched:
  - enterprise_linux_baseos_v_8
---

## Overview

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 7 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105841.json)
- **RHSA-2026:83525** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-10-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:83525)
- **RHSA-2026:86056** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86056)
- **RHSA-2026:89755** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-10-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:89755)