Skip to content
OpenAdvisories
Critical · 9.3 CVE-2026-24812 EUVD-2026-4762GHSA-3qgq-r69m-f2f7

An improper pointer arithmetic in root-project/root at builtins/zlib/inftrees.c

Published Jan 27, 2026 · Updated Mar 3, 2026 · Assigned by GovTech CSG

Description

Vulnerability in root-project root (builtins/zlib modules). This vulnerability is associated with program files inftrees.C.

This issue affects root: through 6.36.00-rc1.

Affected products

VendorProductAffectedFixed
root-project root — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 openjpeg2 No fix yet —
Azure Linux 2 (CBL-Mariner) fltk +1 No fix yet —

References