CVE-2026-85091
Fixed in a distro release EPSS <1%CVSS 7.4
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
Products: zlib
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.21 | zlib | 1.3.2-r1 |
| Alpine 3.22 | zlib | 1.3.2-r1 |
| Alpine 3.23 | zlib | 1.3.2-r1 |
| Alpine 3.24 | zlib | 1.3.2-r1 |
| Chainguard | minizip | 1.3.2.1_rc20260601-r0 |
| Chainguard | zlib | 1.3.2.1_rc20260601-r0 |
| Chainguard | zlib-dev | 1.3.2.1_rc20260601-r0 |
| Chainguard | zlib-doc | 1.3.3-r0 |
| Chainguard | zlib-doc | 1.3.2.1_rc20260601-r0 |
| Chainguard | zlib-static | 1.3.2.1_rc20260601-r0 |
| Chainguard | zlib-static | 1.3.3-r0 |
| Debian 12 | zlib | no fix |
| Debian 13 | zlib | no fix |
| Debian 14 | zlib | no fix |
| Ubuntu 16.04 LTS | zsync | no fix |
| Ubuntu 18.04 LTS | zlib | no fix |
| Ubuntu 18.04 LTS | zsync | no fix |
| Ubuntu 20.04 LTS | zlib | no fix |
| Ubuntu 20.04 LTS | zsync | no fix |
| Ubuntu 22.04 LTS | klibc | no fix |
| Ubuntu 22.04 LTS | zlib | no fix |
| Ubuntu 22.04 LTS | zsync | no fix |
| Ubuntu 24.04 LTS | klibc | no fix |
| Ubuntu 24.04 LTS | zlib | 1:1.3.dfsg-3.1ubuntu2.3 |
| Ubuntu 24.04 LTS | zsync | no fix |
| Ubuntu 26.04 LTS | klibc | no fix |
| Ubuntu 26.04 LTS | zlib | 1:1.3.dfsg+really1.3.1-1ubuntu3.2 |
| Ubuntu 26.04 LTS | zsync | no fix |
| Ubuntu 26.10 | klibc | no fix |
| Ubuntu 26.10 | zlib | 1:1.3.dfsg+really1.3.2-3ubuntu1.1 |
| Ubuntu 26.10 | zsync | no fix |
| Ubuntu Pro 14.04 LTS | klibc | no fix |
| Ubuntu Pro 14.04 LTS | zlib | no fix |
| Ubuntu Pro 16.04 LTS | klibc | no fix |
| Ubuntu Pro 16.04 LTS | rsync | no fix |
| Ubuntu Pro 16.04 LTS | zlib | no fix |
| Ubuntu Pro 18.04 LTS | klibc | no fix |
| Ubuntu Pro 18.04 LTS | rsync | no fix |
| Ubuntu Pro 20.04 LTS | klibc | no fix |
| Ubuntu Pro 20.04 LTS | rsync | no fix |
| Wolfi | minizip | 1.3.2.1_rc20260601-r0 |
| Wolfi | zlib | 1.3.2.1_rc20260601-r0 |
| Wolfi | zlib-dev | 1.3.2.1_rc20260601-r0 |
| Wolfi | zlib-doc | 1.3.2.1_rc20260601-r0 |
| Wolfi | zlib-doc | 1.3.3-r0 |
| Wolfi | zlib-static | 1.3.2.1_rc20260601-r0 |
| Wolfi | zlib-static | 1.3.3-r0 |
| openSUSE Tumbleweed | trivy | 0.76.0-1.1 |