CVE-2026-85091 in Zlib
Summary
by MITRE • 09/03/2026
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The zlib library, specifically versions ranging from 1.3.1.2 through 1.3.2, contains a critical heap-based buffer overflow vulnerability located within the gz_vacate function. This flaw arises during the handling of non-blocking write operations where external buffer pointers become stale or invalid due to prior write stalls. The core technical issue stems from an unchecked memmove operation that fails to properly validate memory boundaries before copying data. When an application utilizes functions such as gzprintf or gzvprintf following a scenario where a previous write operation stalled, the internal state of the gzip stream may retain references to buffers that are no longer valid or sufficiently large for subsequent operations. Consequently, the library attempts to move data into an input buffer without verifying if the destination address plus the length exceeds the allocated heap memory limits. This lack of bounds checking allows an attacker who can control the input data and trigger this specific sequence of calls to write beyond the end of the allocated heap region.
From a security perspective, this vulnerability is classified under CWE-122, which denotes a heap-based buffer overflow. The exploitation potential is significant because writing past the boundaries of a heap allocation can corrupt adjacent memory structures, including metadata used by the allocator or other application data. In many cases, such corruption can be leveraged to achieve arbitrary code execution if an attacker can carefully craft input that overwrites function pointers or object vtables within the corrupted region. Alternatively, even without full code execution, this flaw can lead to denial of service conditions through segmentation faults or memory access violations when the program attempts to use the corrupted heap structures later in its lifecycle. The vulnerability is particularly dangerous because it involves standard I/O functions that are commonly used in network-facing applications, increasing the attack surface for remote exploitation if these libraries process untrusted data streams.
The operational impact of this flaw extends beyond simple crashes or memory corruption. Applications relying on zlib for compressing and decompressing data over networks, such as web servers handling gzip-encoded responses or clients making compressed HTTP requests, are at risk. If an attacker can induce a write stall followed by subsequent formatted writes using gzprintf variants, they may exploit the heap overflow to compromise the integrity of the host system. This aligns with techniques observed in attack patterns where memory corruption is used as a stepping stone for privilege escalation or lateral movement within a compromised environment. The specific trigger condition involving non-blocking I/O and stale pointers suggests that race conditions or timing-based attacks might also be viable vectors, although direct exploitation via crafted input sequences remains the primary concern.
Mitigation strategies must prioritize immediate software updates to address this memory safety issue. Organizations utilizing zlib versions 1.3.1.2 through 1.3.2 should upgrade to a patched version that includes fixes for the gz_vacate function and related internal buffer management logic. In addition to patching, developers implementing these libraries in new code should enforce strict input validation and ensure that all external buffers passed to zlib functions are properly managed with respect to their lifecycles. Implementing memory-safe programming practices, such as using static analysis tools or fuzz testing during the development phase, can help identify similar boundary checking errors before deployment. Furthermore, enabling runtime protection mechanisms like Address Sanitizer (ASan) in debug builds and deploying heap hardening techniques in production environments can provide additional layers of defense against exploitation attempts involving buffer overflows.