CVE-2026-76844
Published: August 24th, 2026
zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.
HIGH
CVSS v3: 7.4
CVSS v3: 7.4
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| daily | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 26.3 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 26.2 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 26.1 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 25.4 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 25.3 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 25.2 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 25.1 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 24.4 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 24.4.0 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 24.3 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 24.2 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 24.1 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 23.3 | zlib (1.3) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 23.2 | zlib (1.2.12) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 23.1 | zlib (1.2.12) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 22.4 | zlib (1.2.12) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 22.3 | zlib (1.2.12) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 22.2 | zlib (1.2.12) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 22.1 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 21.11 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 21.8 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 21.5.0 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 21.2.0 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 11.4.19.3667 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 11.4.18.3599 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 11.4.16.3445 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 11.4.15.3368 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 11.4.14.3263 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 11.4.13.3179 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 11.4.12.3054 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 11.4.11.3040 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 11.4.11.2990 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 11.4.10.2934 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 11.4.9.2878 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
| 11.4.8.2822 | zlib (1.2.11) | Not Affected | Code Not Reachable | The flaw is in zlib’s gzip file-write functions (gzwrite/gzfwrite). Document Filters uses zlib’s deflate API for compression but does not call the vulnerable gzip file-write functions. |
Severity score breakdown
Attack Complexity
HIGH
Attack Vector
NETWORK
Availability Impact
HIGH
Base Score
7.4
Base Severity
HIGH
Confidentiality Impact
NONE
Integrity Impact
HIGH
Privileges Required
NONE
Scope
UNCHANGED
User Interaction
NONE
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Version
3.1