CVE-2026-85091
Published: September 3rd, 2026
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
HIGH
CVSS v3: 7.4
CVSS v3: 7.4
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| daily | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 26.3 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 26.2 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 26.1 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 25.4 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 25.3 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 25.2 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 25.1 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 24.4 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 24.4.0 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 24.3 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 24.2 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 24.1 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 23.3 | zlib (1.3) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 23.2 | zlib (1.2.12) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 23.1 | zlib (1.2.12) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 22.4 | zlib (1.2.12) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 22.3 | zlib (1.2.12) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 22.2 | zlib (1.2.12) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 22.1 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 21.11 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 21.8 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 21.5.0 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 21.2.0 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 11.4.19.3667 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 11.4.18.3599 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 11.4.16.3445 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 11.4.15.3368 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 11.4.14.3263 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 11.4.13.3179 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 11.4.12.3054 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 11.4.11.3040 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 11.4.11.2990 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 11.4.10.2934 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 11.4.9.2878 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
| 11.4.8.2822 | zlib (1.2.11) | Not Affected | Code Not Present | Flaw is in zlib’s gz_vacate() non-blocking gzwrite path, added in 1.3.1.2. Document Filters ships zlib 1.3, which does not contain that code. |
Severity score breakdown
Attack Complexity
HIGH
Attack Vector
NETWORK
Availability Impact
HIGH
Base Score
7.4
Base Severity
HIGH
Confidentiality Impact
NONE
Integrity Impact
HIGH
Privileges Required
NONE
Scope
UNCHANGED
User Interaction
NONE
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Version
3.1