CVE-2026-76844
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
zlib versions 1.2.11 through 1.3.2 contain a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.
Risk Assessment
This can lead to application crashes or potential code execution, posing a serious risk to systems using zlib.
Recommendation
Upgrade zlib to version 1.3.1.2 or later if possible, or apply a workaround by avoiding situations where write() can fail.
Other vulnerabilities in zlib
See all- CVE-2023-45853Critical
In zlib up to version 1.3, the MiniZip component has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field.
- CVE-2022-37434Critical
zlib through version 1.2.12 has a heap-based buffer over-read or buffer overflow in the inflate function in inflate.c due to a large gzip header extra field. Only applications that call inflateGetHeader are affected.
- CVE-2018-25032High
A vulnerability in zlib before version 1.2.12 allows memory corruption during data compression when the input contains many distant matches.
- CVE-2016-9843Critical
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
- CVE-2016-9842High
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
- CVE-2016-9841Critical
In zlib version 1.2.8, the file inffast.c contains a vulnerability due to improper pointer arithmetic. This could allow context-dependent attackers to cause unspecified impacts.
- CVE-2016-9840High
In zlib version 1.2.8, the inftrees.c file contains a vulnerability due to improper pointer arithmetic. This may allow context-dependent attackers to cause unspecified impacts.
- CVE-2005-2096High
A vulnerability in zlib version 1.2 and later allows remote attackers to cause a denial of service (crash) by sending a crafted compressed stream with an incomplete code description of a length greater than 1, leading to a buffer overflow. This is demonstrated using a crafted PNG file.
- CVE-2026-85091High
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
- CVE-2026-22184High
A global buffer overflow vulnerability exists in the untgz utility (contrib/untgz) in zlib versions up to and including 1.3.1.2. The issue is limited to the standalone demonstration tool and does not affect the core zlib compression library. The flaw occurs when a user executes untgz with an excessively long archive name on the command line, causing an out-of-bounds write in a fixed-size global buffer.
Original NVD description (English source)
zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS