Heap Buffer Overflow in zlib Affected by Non-Blocking Operations

CVE-2026-85091

What is CVE-2026-85091?

The vulnerability in zlib versions 1.3.1.2 to 1.3.2 involves a heap buffer overflow in the gz_vacate() function, specifically when processing non-blocking gzwrite() operations with stale external buffer pointers. An attacker can exploit this flaw by invoking gzprintf() or gzvprintf() after a write stall, which triggers an unchecked memmove() operation that writes beyond the internal input buffer's boundaries. This could lead to memory corruption, potentially allowing an attacker to execute arbitrary code or manipulate sensitive information.

References