Description
zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zlib | zlib | 1.2.11 – ≤ 1.3.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zlib | 1:1.3.dfsg+really1.3.2-4 | — |
| Debian 13 | zlib | 1:1.3.dfsg+really1.3.1-1+deb13u1 | — |
| Debian 12 | zlib | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | zlib | 1.3.2-2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
perplexedyawdie/cve-2026-76844-lab ★ 0 · Nov 10, 2026
One CVE ID, two packages: reproducing CVE-2026-76844 in Trivy with a pinned vulnerability DB
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | webpack-dev-middleware | >= 8.0.0, < 8.3.0 | 8.3.0 | GHSA-g84c-rxfj-3j2c |
| npm | webpack-dev-middleware | < 7.4.6 | 7.4.6 | GHSA-g84c-rxfj-3j2c |
References
- Technical report and proof of concept technical-description exploit
- Patch Commit patch
- https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393 technical-description
- https://github.com/madler/zlib product
- VulnCheck Advisory: zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate third-party-advisory