CVE-2026-85091

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow (CWE-787, out-of-bounds write) in the gz_vacate() function, which mishandles a stale pointer to an external buffer during non-blocking gzwrite() operations. An attacker triggers the flaw by calling gzprintf() or gzvprintf() on a gzip stream after a write has stalled, causing an unchecked memmove() to write beyond the end of the internal input buffer. The resulting heap corruption yields high integrity and availability impact per the CVSS 4.0 score of 8.3 (High), meaning crashes or controlled memory corruption are possible, though with a network vector and high attack complexity and no confidentiality impact. Anyone shipping or running the affected zlib versions whose code uses the gz* file API in non-blocking mode is affected, while applications that only call deflate()/inflate() are not exposed. There is no public PoC, no CISA KEV listing, and no known exploitation; EPSS estimates a 0.4% probability of exploitation within 30 days.

What to do: Inventory systems for zlib 1.3.1.2/1.3.2 using SBOMs or package listings and prioritize any application code that uses gzopen()/gzwrite()/gzprintf() in non-blocking mode. Upgrade to a zlib release newer than 1.3.2 as soon as your distribution or vendor ships the fixed package, or avoid/restrict the non-blocking gz* code path until patched. Monitor distro security advisories, since most users will receive the fix as a packaged zlib update rather than a direct library rebuild.