CVE-2022-37434
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
zlib through version 1.2.12 has a heap-based buffer over-read or buffer overflow in the inflate function in inflate.c due to a large gzip header extra field. Only applications that call inflateGetHeader are affected.
Risk Assessment
An attacker could exploit this vulnerability to access sensitive memory data or cause application crashes, potentially leading to confidentiality or availability breaches.
Recommendation
Update zlib to version 1.2.13 or later, which includes the fix. Applications that do not call inflateGetHeader are not affected.
Original NVD description (English source)
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).