CVE Feed

    Dashboard / CVE / CVE-2026-22184

    CVE-2026-22184

    zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.

    Published:Jan 7, 2026
    Last Modified:Apr 16, 2026
    EPS:Jan 7, 2026
    EPSS Score:0.00006
    CVSS Score:7.8

    Affected Products

    Vendor
    Zlib
    Product
    Zlib

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-85091 (CVSS 8.3) — zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function w…
    CVE-2026-27171 (CVSS 2.9) — zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do ri…
    CVE-2025-0725 (CVSS 7.3) — When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURL…
    CVE-2023-45853 (CVSS 9.8) — MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFile…
    CVE-2022-37434 (CVSS 9.8) — zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large g…
    CVE-2018-25032 (CVSS 7.5) — zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many dist…
    CVE-2016-9843 (CVSS 9.8) — The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified im…
    CVE-2016-9840 (CVSS 8.8) — inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging impr…
    CVE-2016-9841 (CVSS 9.8) — inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging impro…
    CVE-2016-9842 (CVSS 8.8) — The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecifie…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High