CVE-2026-85091
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
Risk Assessment
Risk of remote code execution or application crashes in software using zlib, potentially leading to data integrity and service availability issues.
Recommendation
Upgrade zlib to version 1.3.3 or later and test applications using gzprintf/gzvprintf functions.
Other vulnerabilities in zlib
See all- CVE-2023-45853Critical
In zlib up to version 1.3, the MiniZip component has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field.
- CVE-2022-37434Critical
zlib through version 1.2.12 has a heap-based buffer over-read or buffer overflow in the inflate function in inflate.c due to a large gzip header extra field. Only applications that call inflateGetHeader are affected.
- CVE-2018-25032High
A vulnerability in zlib before version 1.2.12 allows memory corruption during data compression when the input contains many distant matches.
- CVE-2016-9843Critical
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
- CVE-2016-9842High
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
- CVE-2016-9841Critical
In zlib version 1.2.8, the file inffast.c contains a vulnerability due to improper pointer arithmetic. This could allow context-dependent attackers to cause unspecified impacts.
- CVE-2016-9840High
In zlib version 1.2.8, the inftrees.c file contains a vulnerability due to improper pointer arithmetic. This may allow context-dependent attackers to cause unspecified impacts.
- CVE-2005-2096High
A vulnerability in zlib version 1.2 and later allows remote attackers to cause a denial of service (crash) by sending a crafted compressed stream with an incomplete code description of a length greater than 1, leading to a buffer overflow. This is demonstrated using a crafted PNG file.
- CVE-2026-22184High
A global buffer overflow vulnerability exists in the untgz utility (contrib/untgz) in zlib versions up to and including 1.3.1.2. The issue is limited to the standalone demonstration tool and does not affect the core zlib compression library. The flaw occurs when a user executes untgz with an excessively long archive name on the command line, causing an out-of-bounds write in a fixed-size global buffer.
Original NVD description (English source)
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.