AIKIDO-2026-207367

zlib is vulnerable to Out-of-bounds Write

CVE-2026-85091Published Sep 22, 2026

CVE Score

High

Out-of-bounds Write

TL;DR

Affected versions of zlib contain a heap buffer overflow in gz_vacate() when a non-blocking gzwrite() stalls and leaves strm->next_in pointing at the caller's external buffer. A later gzprintf() or gzvprintf() call then runs an unbounded memmove() past the internal input buffer. An attacker who can stall the destination, for example a peer that stops reading a socket, can overwrite adjacent heap memory and crash the process. The overflow is fixed in commit df84af2, which addresses CVE-2026-85091, but no patched release has been tagged yet.

How do I fix this?

There is no patched release yet. Upgrade zlib once a version newer than 1.3.2 is published, or apply https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148. Until then, avoid calling gzprintf() or gzvprintf() after a stalled non-blocking gzwrite().

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application writes gzip data with gzwrite(), gzprintf(), or gzvprintf() to a non-blocking file descriptor.