zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Deployments using zlib versions before 1.2.12 are affected when they perform deflate compression on attacker-influenced input containing many distant matches.
The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. The attacker needs to cause the affected zlib instance to compress crafted input.
Successful exploitation can cause memory corruption during compression and has a high availability impact. The supplied severity vector does not indicate confidentiality or integrity impact.
The provided data does not identify a workaround. Prioritize limiting or avoiding compression of untrusted input until zlib can be updated to 1.2.12 or later.