PatchTheCVECVE-2010-0001: Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompres
CVE-2010-0001 is a medium-severity flaw (CVSS 6.8) affecting gzip. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted archive that uses LZW compression, leading to an array index error.
Why this priority
- EPSS top 8%: very likely to be exploited
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.8 (Medium) |
| EPSS exploit chance | 4.8% (top 8%) |
| CISA exploited list | No |
| Weakness | CWE-189 |
| Published | 2010-01-29 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2010-0001?
gzip: upgrade to newer than 1.3.13. Exact commands for each OS are on this page.
Is CVE-2010-0001 being exploited?
CVE-2010-0001 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2010-0001 affect?
CVE-2010-0001 affects gzip. Severity is medium (CVSS 6.8). Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code
How urgent is CVE-2010-0001?
Priority 47/100. EPSS top 8%: very likely to be exploited
Related CVEs
- CVE-2026-41992 HIGH 7.5 UPGRADE GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reu
- CVE-2026-41991 MEDIUM 4.7 UPGRADE GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling
- CVE-2022-1271 HIGH 8.8 UPGRADE DOWNGRADE An arbitrary file write vulnerability was found in GNU gzip's zgrep utility
- CVE-2009-2624 MEDIUM 6.8 UPGRADE The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too sma
- CVE-2006-4338 MEDIUM 5.0 DOWNGRADE unlzh.c in the LHZ component in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (in