zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Deployments using zlib versions earlier than 1.2.12 are exposed when they perform deflate compression on attacker-controlled or otherwise untrusted input containing many distant matches.
The issue is network-reachable with low attack complexity and requires no privileges or user interaction. Exploitation depends on causing the affected zlib instance to compress specially crafted input.
Successful exploitation can cause memory corruption during compression and has a high availability impact. The provided assessment lists no confidentiality or integrity impact.
Identify the zlib version used by the application or product. Versions before 1.2.12 are affected; the issue is relevant where the application invokes deflate compression.