CVE-2026-22184
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A global buffer overflow vulnerability exists in the untgz utility (contrib/untgz) in zlib versions up to and including 1.3.1.2. The issue is limited to the standalone demonstration tool and does not affect the core zlib compression library. The flaw occurs when a user executes untgz with an excessively long archive name on the command line, causing an out-of-bounds write in a fixed-size global buffer.
Risk Assessment
The risk to the organization is limited as the vulnerability only affects the untgz helper utility, not the core zlib library. Exploitation requires user interaction (running the tool with a long filename), reducing the likelihood of remote exploitation.
Recommendation
It is recommended to upgrade zlib to a version later than 1.3.1.2 if the untgz utility is used in production. If untgz is not needed, it can be removed or access to it restricted.
Other vulnerabilities in zlib
See all- CVE-2023-45853Critical
In zlib up to version 1.3, the MiniZip component has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field.
- CVE-2022-37434Critical
zlib through version 1.2.12 has a heap-based buffer over-read or buffer overflow in the inflate function in inflate.c due to a large gzip header extra field. Only applications that call inflateGetHeader are affected.
- CVE-2018-25032High
A vulnerability in zlib before version 1.2.12 allows memory corruption during data compression when the input contains many distant matches.
- CVE-2016-9843Critical
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
- CVE-2016-9842High
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
- CVE-2016-9841Critical
In zlib version 1.2.8, the file inffast.c contains a vulnerability due to improper pointer arithmetic. This could allow context-dependent attackers to cause unspecified impacts.
- CVE-2016-9840High
In zlib version 1.2.8, the inftrees.c file contains a vulnerability due to improper pointer arithmetic. This may allow context-dependent attackers to cause unspecified impacts.
- CVE-2005-2096High
A vulnerability in zlib version 1.2 and later allows remote attackers to cause a denial of service (crash) by sending a crafted compressed stream with an incomplete code description of a length greater than 1, leading to a buffer overflow. This is demonstrated using a crafted PNG file.
Original NVD description (English source)
zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.