Read the docs
TI-2026-58450 Aliases CVE-2026-85091GHSA-g5fp-32jq-cfw2

zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate

Priority HIGH 71CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00469 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zlibzlib1.3.1.2 – 1.3.2—No fix listedCNA
  • zlib Vendorzlib Affected 1.3.1.2 – 1.3.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85091
  2. 2026-10-03 Alias added: GHSA-g5fp-32jq-cfw2
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Exploit 1

Other 2

  • TI-2022-17498 zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in… CVSS 3.1CRITICAL 9.8
  • TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
  • TI-2026-53680 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write CVSS 4.0HIGH 8.3
  • TI-2026-17794 zlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname() CVSS 4.0MEDIUM 4.6
  • TI-2016-07970 inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified… CVSS 3.1CRITICAL 9.8
  • TI-2026-21613 zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64… CVSS 3.1MEDIUM 5.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences