CVE-2026-85091

EUVD-2026-70301
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 27.65%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
zlibzlib
1.3.1.2 ≤
𝑥
≤ 1.3.2
CNA
Debian logo
Debian Releases
Debian Product
Codename
zlib
bookworm
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
zlib
bionic
deferred
focal
deferred
jammy
deferred
noble
deferred
resolute
deferred
trusty
deferred
xenial
deferred
rsync
bionic
deferred
focal
deferred
jammy
not-affected
noble
not-affected
resolute
not-affected
trusty
not-affected
xenial
deferred
klibc
bionic
deferred
focal
deferred
jammy
deferred
noble
deferred
resolute
deferred
trusty
deferred
xenial
deferred
zsync
bionic
deferred
focal
deferred
jammy
deferred
noble
deferred
resolute
deferred
xenial
deferred
Common Weakness Enumeration
References
https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
https://github.com/madler/zlib
https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate