CVE-2022-37434
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
zlib through version 1.2.12 has a heap-based buffer over-read or buffer overflow in the inflate function in inflate.c due to a large gzip header extra field. Only applications that call inflateGetHeader are affected.
Risk Assessment
An attacker could exploit this vulnerability to access sensitive memory data or cause application crashes, potentially leading to confidentiality or availability breaches.
Recommendation
Update zlib to version 1.2.13 or later, which includes the fix. Applications that do not call inflateGetHeader are not affected.
Other vulnerabilities in zlib
See all- CVE-2023-45853Critical
In zlib up to version 1.3, the MiniZip component has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field.
- CVE-2018-25032High
A vulnerability in zlib before version 1.2.12 allows memory corruption during data compression when the input contains many distant matches.
- CVE-2016-9843Critical
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
- CVE-2016-9842High
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
- CVE-2016-9841Critical
In zlib version 1.2.8, the file inffast.c contains a vulnerability due to improper pointer arithmetic. This could allow context-dependent attackers to cause unspecified impacts.
- CVE-2016-9840High
In zlib version 1.2.8, the inftrees.c file contains a vulnerability due to improper pointer arithmetic. This may allow context-dependent attackers to cause unspecified impacts.
- CVE-2005-2096High
A vulnerability in zlib version 1.2 and later allows remote attackers to cause a denial of service (crash) by sending a crafted compressed stream with an incomplete code description of a length greater than 1, leading to a buffer overflow. This is demonstrated using a crafted PNG file.
- CVE-2026-85091High
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
- CVE-2026-22184High
A global buffer overflow vulnerability exists in the untgz utility (contrib/untgz) in zlib versions up to and including 1.3.1.2. The issue is limited to the standalone demonstration tool and does not affect the core zlib compression library. The flaw occurs when a user executes untgz with an excessively long archive name on the command line, causing an out-of-bounds write in a fixed-size global buffer.
Original NVD description (English source)
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).