| Name | CVE-2026-85091 |
| Description | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1146895 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| zlib (PTS) | bookworm | 1:1.2.13.dfsg-1 | vulnerable |
| trixie | 1:1.3.dfsg+really1.3.1-1 | vulnerable | |
| forky, sid | 1:1.3.dfsg+really1.3.2-3 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| zlib | source | (unstable) | (unfixed) | 1146895 |
https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
https://github.com/madler/zlib/issues/1310
https://github.com/madler/zlib/pull/1317
Fixed by: https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148
Discussion on affected range: https://github.com/madler/zlib/issues/1310#issuecomment-5979623265
Support non-blocking devices in the gz* routines introduced with:
https://github.com/madler/zlib/commit/81cc0bebedd935daeb81b0b6e475d8786b51af3d (v1.3.1.2)