CVE-2026-76844
CVE-2026-76844 · zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.
CVSS 8.3 · Alta · EPSS 0,6% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
zlib
- Versiones
- ≥ 1.2.11, ≤ 1.3.2: Afectada (custom)
Sin corrección publicada
webpack-dev-middleware npm
- Intervalos de versiones afectados
- SEMVER: ≥ 8.0.0, < 8.3.0
Actualiza a 8.3.0
webpack-dev-middleware npm
- Intervalos de versiones afectados
- SEMVER: < 7.4.6
Actualiza a 7.4.6
Fuentes originales
- https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
- https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148
- https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
- https://github.com/madler/zlib
- https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate
- https://nvd.nist.gov/vuln/detail/CVE-2026-76844