CVE-2026-85091: zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gzvacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zlibto a version that resolves this vulnerability.Fixed in 1.3.2
Event History
Frequently Asked Questions
Which application workflows are exposed to this issue?
Applications using affected zlib versions are exposed when they perform non-blocking gzwrite() operations, encounter a write stall, and subsequently call gzprintf() or gzvprintf(). The issue involves stale external buffer pointers during that sequence.
Does exploitation require authentication or user interaction?
The supplied severity vector indicates network attackability with no privileges required and no user interaction required. It also rates attack complexity as high.
How can I determine whether my deployment is affected?
Verify whether the deployed zlib version is from 1.3.1.2 through 1.3.2 and whether the application uses the affected non-blocking gzwrite() workflow followed by gzprintf() or gzvprintf() after write stalls.