Red Hat Patches Two Important lrzsz File Transfer Flaws Across Enterprise Linux 8
Red Hat published security advisory RHSA-2026:83525 on 15 October 2026, covering two vulnerabilities in the lrzsz package shipped with Red Hat Enterprise Linux 8. The package provides the lrz and lsz utilities, a GNU-licensed implementation of the zmodem, ymodem and xmodem protocols still widely used to move files over serial links, terminal sessions and out-of-band console connections. Red Hat Product Security rated the update as Important and tracks the two issues as CVE-2026-105840, an arbitrary file overwrite through absolute path traversal while running in restricted mode, and CVE-2026-105841, arbitrary command execution through crafted file names in pipe mode. The advisory covers Red Hat Enterprise Linux for x86_64, IBM z Systems, Power little endian and ARM 64 on the version 8 streams, together with the matching Extended Life Cycle channels for 8.10. The same release also carries a non-security fix for a segfault triggered by the -s option, tracked internally as RHEL-282148.
Red Hat has described both flaws only at the level of their effect and has not published a step-by-step exploitation path, so the mechanics below are limited to what the advisory itself states. CVE-2026-105840 concerns restricted mode, the operating mode intended to confine an incoming transfer to a permitted directory; the advisory states that an absolute path can defeat that confinement and result in arbitrary files being overwritten. CVE-2026-105841 concerns pipe mode, where the advisory states that a crafted file name leads to arbitrary command execution rather than a simple write. The common thread in the two entries is the file name metadata supplied by the remote end of a zmodem or ymodem session, which the receiving utility acts upon. No CVSS base score is reproduced in the errata text itself; Red Hat directs readers to the individual CVE pages for scoring and acknowledgements, and the corresponding Bugzilla entries are 2546590 and 2546595. Fixed builds are available as lrzsz-0.12.20-46.el8_10 for every listed architecture, along with the matching debuginfo and debugsource packages.
The practical exposure here is narrower than the Important rating alone suggests, but it is not zero. lrzsz tends to live on jump hosts, serial console servers, embedded management workstations and lab infrastructure, precisely the systems that sit adjacent to network gear and out-of-band management planes, and the utilities frequently run with the privileges of an operator rather than a sandboxed service account. Both issues require the victim to initiate or accept a transfer from a remote peer the attacker controls, which rules out unauthenticated internet-facing mass exploitation but fits scenarios such as a compromised device at the far end of a console cable or a malicious transfer offered during a support session. A successful file overwrite against a path such as a shell profile or a cron directory converts a file transfer utility into a foothold, and the pipe mode command execution issue removes even that intermediate step. On current exploitation status, the evidence is modest: FIRST EPSS places CVE-2026-105840 at a 0.3 percent probability of exploitation in the next thirty days and CVE-2026-105841 at 0.9 percent, and neither CVE is recorded as being exploited in the wild. Because RHEL 8 remains in extended life cycle support, a large installed base of long-lived systems carries the vulnerable package even where interactive serial transfers are rare, and unpatched hosts will keep that latent exposure for as long as the utilities remain installed.
Attack Surface
File Transfer, Server OS, Endpoint OS
Tactics
Execution, Defense Evasion, Impact
Techniques
- T1059 – Command and Scripting Interpreter
- T1565.001 – Data Manipulation: Stored Data Manipulation
- T1211 – Exploitation for Defense Evasion
SuperPRO's Threat Countermeasures Procedures
- Update lrzsz to version 0.12.20-46.el8_10 or later on all Red Hat Enterprise Linux 8 hosts using 'dnf update lrzsz'; this build fixes CVE-2026-105840 and CVE-2026-105841 and is published for x86_64, s390x, ppc64le and aarch64.
- Inventory affected systems with 'rpm -q lrzsz' across the estate, or use the Red Hat Lightspeed patch analysis view linked from RHSA-2026:83525 to list hosts still carrying a pre-46.el8_10 build.
- Include Extended Life Cycle Support subscribers in the same sweep – RHEL 8.10 ELS channels for x86_64, aarch64, ppc64le and s390x ship the identical vulnerable package and the identical 0.12.20-46.el8_10 fix.
- Remove the package with 'dnf remove lrzsz' on jump hosts, bastions and build servers that do not perform zmodem, ymodem or xmodem transfers, eliminating the lrz and lsz binaries rather than leaving unused attack surface in place.
- Verify downloaded RPMs against the SHA-256 digests published in the errata before deployment, for example 76f89442d9cc7495d390f6683c620c830cd8d403b0a89936de32abb0ba5a8c59 for lrzsz-0.12.20-46.el8_10.x86_64.rpm and 7f845f3b5fea407cafc2146953b9d054204cdaea1db3875c4f7ebf2a5d2bcdc9 for the source RPM.
- Add auditd rules on console and terminal servers to log execve of /usr/bin/lrz and /usr/bin/lsz, and alert where an lrz process writes outside the intended transfer directory – the absolute path traversal in CVE-2026-105840 shows as file creation under paths such as /etc, /root or cron directories.
- Validate the regression fix for the segfault triggered by lsz -s (JIRA RHEL-282148) in test before rolling the 46.el8_10 build to automation that scripts lrzsz transfers, so the update does not disrupt existing serial transfer workflows.
