Skip to content
OpenAdvisories
Critical · 9.3 CVE-2026-24811 EUVD-2026-4830GHSA-fm67-x2fw-2g76

An improper pointer arithmetic in root-project/root at builtins/zlib/inffast.c

Published Jan 27, 2026 · Updated Feb 19, 2026 · Assigned by GovTech CSG

Description

Vulnerability in root-project root (builtins/zlib modules). This vulnerability is associated with program files inffast.C.

This issue affects root.

Affected products

VendorProductAffectedFixed
root-project root — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 openjpeg2 No fix yet —
Azure Linux 2 (CBL-Mariner) fltk +1 No fix yet —

References