AIKIDO-2026-207367

zlib is vulnerable to Out-of-bounds Write

Out-of-bounds WriteCVE-2026-85091 Published 2 days ago

High Risk

This Affects:

zlib

1.3.1.2 - 1.3.2

Are you affected? Scan for Free

TL;DR

Affected versions of zlib contain a heap buffer overflow in gz_vacate() when a non-blocking gzwrite() stalls and leaves strm->next_in pointing at the caller's external buffer. A later gzprintf() or gzvprintf() call then runs an unbounded memmove() past the internal input buffer. An attacker who can stall the destination, for example a peer that stops reading a socket, can overwrite adjacent heap memory and crash the process. The overflow is fixed in commit df84af2, which addresses CVE-2026-85091, but no patched release has been tagged yet.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application writes gzip data with gzwrite(), gzprintf(), or gzvprintf() to a non-blocking file descriptor.

Background info

zlib is vulnerable to Out-of-bounds Write in versions 1.3.1.2 - 1.3.2.

How to fix this

There is no patched release yet. Upgrade zlib once a version newer than 1.3.2 is published, or apply https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148. Until then, avoid calling gzprintf() or gzvprintf() after a stalled non-blocking gzwrite().