Skip to content
OpenAdvisories
High USN-8954-1 1 CVE

zlib vulnerability

Published Oct 22, 2026 · Updated Oct 23, 2026

Ecosystem: Ubuntu

Summary

Ali Firas discovered that zlib incorrectly handled certain non-blocking
write operations. An attacker could possibly use this issue to trigger a
heap buffer overflow, resulting in a denial of service or arbitrary code
execution.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS zlib 1:1.3.dfsg-3.1ubuntu2.3
Ubuntu · 26.04 LTS 26.04:LTS zlib 1:1.3.dfsg+really1.3.1-1ubuntu3.2
Ubuntu · 26.10 zlib 1:1.3.dfsg+really1.3.2-3ubuntu1.1

Vulnerabilities 1

  • High 7.4
    CVE-2026-85091

    zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate

    zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzv…

    zlib zlib mysql kata-containers Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2026-85091