CVE Feed

    Dashboard / CVE / CVE-2026-85091

    CVE-2026-85091

    zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

    Published:Sep 3, 2026
    Last Modified:Sep 3, 2026
    EPS:Sep 3, 2026
    EPSS Score:0.00442
    CVSS Score:7.4

    Affected Products

    Vendor
    Zlib
    Product
    Zlib

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-787 Out-of-bounds Write

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-27171 (CVSS 2.9) — zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do ri…
    CVE-2026-22184 (CVSS 4.6) — zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under …
    CVE-2025-0725 (CVSS 7.3) — When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURL…
    CVE-2023-45853 (CVSS 9.8) — MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFile…
    CVE-2022-37434 (CVSS 9.8) — zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large g…
    CVE-2018-25032 (CVSS 7.5) — zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many dist…
    CVE-2016-9843 (CVSS 9.8) — The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified im…
    CVE-2016-9840 (CVSS 8.8) — inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging impr…
    CVE-2016-9841 (CVSS 9.8) — inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging impro…
    CVE-2016-9842 (CVSS 8.8) — The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecifie…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High