p PatchFirst

CVE-2026-85091

CVE-2026-85091 · zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

CVSS 8.3 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • zlib

    Versions
    • ≥ 1.3.1.2, ≤ 1.3.2: Affected (custom)

    No fix published

  • zlib Debian:12

    Versions
    • 1:1.2.13.dfsg-1
    • 1:1.2.13.dfsg-2
    • 1:1.2.13.dfsg-3
    • 1:1.3.dfsg+really1.3.1-1
    • 1:1.3.dfsg+really1.3.1-2
    • 1:1.3.dfsg+really1.3.1-3
    • 1:1.3.dfsg+really1.3.2-1
    • 1:1.3.dfsg+really1.3.2-2
    • 1:1.3.dfsg+really1.3.2-3
    • 1:1.3.dfsg-1
    • 1:1.3.dfsg-2
    • 1:1.3.dfsg-3
    • 1:1.3.dfsg-3.1
    • 1:1.3.dfsg-3.1~exp1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zlib Debian:13

    Versions
    • 1:1.3.dfsg+really1.3.1-1
    • 1:1.3.dfsg+really1.3.1-2
    • 1:1.3.dfsg+really1.3.1-3
    • 1:1.3.dfsg+really1.3.2-1
    • 1:1.3.dfsg+really1.3.2-2
    • 1:1.3.dfsg+really1.3.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zlib Debian:14

    Versions
    • 1:1.3.dfsg+really1.3.1-1
    • 1:1.3.dfsg+really1.3.1-2
    • 1:1.3.dfsg+really1.3.1-3
    • 1:1.3.dfsg+really1.3.2-1
    • 1:1.3.dfsg+really1.3.2-2
    • 1:1.3.dfsg+really1.3.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • klibc Ubuntu:Pro:14.04:LTS

    Versions
    • 2.0.1-3.1ubuntu2
    • 2.0.2-1ubuntu1
    • 2.0.2-1ubuntu2
    • 2.0.3-0ubuntu1
    • 2.0.3-0ubuntu1.14.04.1
    • 2.0.3-0ubuntu1.14.04.2
    • 2.0.3-0ubuntu1.14.04.3
    • 2.0.3-0ubuntu1.14.04.3+esm2
    • 2.0.3-0ubuntu1.14.04.3+esm3
    • 2.0.3-0ubuntu1.14.04.3+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zlib Ubuntu:Pro:14.04:LTS

    Versions
    • 1:1.2.8.dfsg-1ubuntu1
    • 1:1.2.8.dfsg-1ubuntu1.1
    • 1:1.2.8.dfsg-1ubuntu1.1+esm1
    • 1:1.2.8.dfsg-1ubuntu1.1+esm2
    • 1:1.2.8.dfsg-1ubuntu1.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • klibc Ubuntu:Pro:16.04:LTS

    Versions
    • 2.0.3-0ubuntu1
    • 2.0.4-4
    • 2.0.4-6
    • 2.0.4-7
    • 2.0.4-8
    • 2.0.4-8ubuntu1
    • 2.0.4-8ubuntu1.16.04.1
    • 2.0.4-8ubuntu1.16.04.2
    • 2.0.4-8ubuntu1.16.04.3
    • 2.0.4-8ubuntu1.16.04.4
    • 2.0.4-8ubuntu1.16.04.4+esm1
    • 2.0.4-8ubuntu1.16.04.4+esm2
    • 2.0.4-8ubuntu1.16.04.4+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rsync Ubuntu:Pro:16.04:LTS

    Versions
    • 3.1.1-3
    • 3.1.1-3ubuntu1
    • 3.1.1-3ubuntu1.1
    • 3.1.1-3ubuntu1.2
    • 3.1.1-3ubuntu1.3
    • 3.1.1-3ubuntu1.3+esm1
    • 3.1.1-3ubuntu1.3+esm2
    • 3.1.1-3ubuntu1.3+esm3
    • 3.1.1-3ubuntu1.3+esm4
    • 3.1.1-3ubuntu1.3+esm5
    • 3.1.1-3ubuntu1.3+esm6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zlib Ubuntu:Pro:16.04:LTS

    Versions
    • 1:1.2.8.dfsg-2ubuntu4
    • 1:1.2.8.dfsg-2ubuntu4.1
    • 1:1.2.8.dfsg-2ubuntu4.3
    • 1:1.2.8.dfsg-2ubuntu4.3+esm1
    • 1:1.2.8.dfsg-2ubuntu4.3+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zsync Ubuntu:16.04:LTS

    Versions
    • 0.6.2-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • klibc Ubuntu:Pro:18.04:LTS

    Versions
    • 2.0.4-9ubuntu1
    • 2.0.4-9ubuntu2
    • 2.0.4-9ubuntu2.1
    • 2.0.4-9ubuntu2.2
    • 2.0.4-9ubuntu2.2+esm1
    • 2.0.4-9ubuntu2.2+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rsync Ubuntu:Pro:18.04:LTS

    Versions
    • 3.1.2-2
    • 3.1.2-2.1
    • 3.1.2-2.1ubuntu1
    • 3.1.2-2.1ubuntu1.1
    • 3.1.2-2.1ubuntu1.2
    • 3.1.2-2.1ubuntu1.3
    • 3.1.2-2.1ubuntu1.4
    • 3.1.2-2.1ubuntu1.5
    • 3.1.2-2.1ubuntu1.6
    • 3.1.2-2.1ubuntu1.6+esm1
    • 3.1.2-2.1ubuntu1.6+esm2
    • 3.1.2-2.1ubuntu1.6+esm3
    • 3.1.2-2.1ubuntu1.6+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zlib Ubuntu:18.04:LTS

    Versions
    • 1:1.2.11.dfsg-0ubuntu2
    • 1:1.2.11.dfsg-0ubuntu2.1
    • 1:1.2.11.dfsg-0ubuntu2.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zsync Ubuntu:18.04:LTS

    Versions
    • 0.6.2-2ubuntu1
    • 0.6.2-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • klibc Ubuntu:Pro:20.04:LTS

    Versions
    • 2.0.6-1ubuntu1
    • 2.0.6-1ubuntu2
    • 2.0.7-1ubuntu1
    • 2.0.7-1ubuntu3
    • 2.0.7-1ubuntu4
    • 2.0.7-1ubuntu5
    • 2.0.7-1ubuntu5.1
    • 2.0.7-1ubuntu5.2
    • 2.0.7-1ubuntu5.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rsync Ubuntu:Pro:20.04:LTS

    Versions
    • 3.1.3-6
    • 3.1.3-8
    • 3.1.3-8ubuntu0.1
    • 3.1.3-8ubuntu0.2
    • 3.1.3-8ubuntu0.3
    • 3.1.3-8ubuntu0.4
    • 3.1.3-8ubuntu0.5
    • 3.1.3-8ubuntu0.7
    • 3.1.3-8ubuntu0.8
    • 3.1.3-8ubuntu0.9
    • 3.1.3-8ubuntu0.9+esm1
    • 3.1.3-8ubuntu0.9+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zlib Ubuntu:20.04:LTS

    Versions
    • 1:1.2.11.dfsg-1ubuntu3
    • 1:1.2.11.dfsg-2ubuntu1
    • 1:1.2.11.dfsg-2ubuntu1.1
    • 1:1.2.11.dfsg-2ubuntu1.2
    • 1:1.2.11.dfsg-2ubuntu1.3
    • 1:1.2.11.dfsg-2ubuntu1.4
    • 1:1.2.11.dfsg-2ubuntu1.5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zsync Ubuntu:20.04:LTS

    Versions
    • 0.6.2-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • klibc Ubuntu:22.04:LTS

    Versions
    • 2.0.8-6.1ubuntu2
    • 2.0.10-3
    • 2.0.10-4
    • 2.0.10-4ubuntu0.1
    • 2.0.10-4ubuntu0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zlib Ubuntu:22.04:LTS

    Versions
    • 1:1.2.11.dfsg-2ubuntu7
    • 1:1.2.11.dfsg-2ubuntu9
    • 1:1.2.11.dfsg-2ubuntu9.1
    • 1:1.2.11.dfsg-2ubuntu9.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zsync Ubuntu:22.04:LTS

    Versions
    • 0.6.2-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • klibc Ubuntu:24.04:LTS

    Versions
    • 2.0.13-1
    • 2.0.13-2
    • 2.0.13-2ubuntu1
    • 2.0.13-4
    • 2.0.13-4ubuntu0.1
    • 2.0.13-4ubuntu0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zlib Ubuntu:24.04:LTS

    Versions
    • 1:1.2.13.dfsg-1ubuntu5
    • 1:1.3.dfsg-3ubuntu1
    • 1:1.3.dfsg-3.1ubuntu1
    • 1:1.3.dfsg-3.1ubuntu2
    • 1:1.3.dfsg-3.1ubuntu2.1
    • 1:1.3.dfsg-3.1ubuntu2.2
    Affected ranges
    • ECOSYSTEM: < 1:1.3.dfsg-3.1ubuntu2.3

    Update to 1:1.3.dfsg-3.1ubuntu2.3

  • zsync Ubuntu:24.04:LTS

    Versions
    • 0.6.2-5
    • 0.6.2-5build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →