Description
zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zlib | zlib | 1.2.11 – ≤ 1.3.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zlib | 1:1.3.dfsg+really1.3.2-4 | — |
| Debian 13 | zlib | 1:1.3.dfsg+really1.3.1-1+deb13u1 | — |
| Debian 12 | zlib | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | klibc +1 | No fix yet | — |
| Ubuntu 26.10 | zlib | 1:1.3.dfsg+really1.3.2-3ubuntu1.1 | USN-8954-1 |
| Ubuntu 26.04 LTS | zlib | 1:1.3.dfsg+really1.3.1-1ubuntu3.2 | USN-8954-1 |
| Ubuntu 24.04 LTS | zlib | 1:1.3.dfsg-3.1ubuntu2.3 | USN-8954-1 |
| Ubuntu 20.04 LTS | zsync | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | klibc +1 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | klibc +1 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | klibc +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | zlib +1 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | trivy | 0.76.0-1.1 | openSUSE-SU-2026:12206-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | zlib | 1.3.2-r1 | — |
| Alpine v3.23 | zlib | 1.3.2-r1 | — |
| Alpine v3.22 | zlib | 1.3.2-r1 | — |
| Alpine v3.21 | zlib | 1.3.2-r1 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | mysql +3 | No fix yet | — |
| Azure Linux 3 | zlib | 1.3.2-2 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | zlib +4 | 1.3.2.1_rc20260601-r0 | — |
Advisories 3
- WID-SEC-2026-3153 zlib: Schwachstelle ermöglicht Denial of Service und Integritätsverlust BSI CERT-Bund (WID) · Nov 8, 2026
- USN-8954-1 zlib vulnerability Ubuntu Security Notices (USN) · Oct 23, 2026
- openSUSE-SU-2026:12206-1 trivy-0.76.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 21, 2026
References
- Technical report and proof of concept technical-description exploit
- Patch Commit patch
- https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393 technical-description
- https://github.com/madler/zlib product
- VulnCheck Advisory: zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate third-party-advisory