Zlib (1.3.1.2 - 1.3.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/zlib-1.3.1.2---1.3.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 03 Sep 2026 13:21:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHeap-based Buffer Overflow in zlib gz_vacate Functionhttps://feed.craftedsignal.io/briefs/2026-09-zlib-heap-overflow/Thu, 03 Sep 2026 13:21:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-zlib-heap-overflow/zlib versions 1.3.1.2 through 1.3.2 are susceptible to a heap-based buffer overflow in the gz_vacate function, which can be triggered by specific non-blocking write operations to achieve memory corruption.zlib versions 1.3.1.2 through 1.3.2 contain a heap-based buffer overflow vulnerability located within the gz_vacate() function. This vulnerability manifests when the library processes non-blocking gzwrite() operations while handling stale external buffer pointers. An attacker can force the execution of this vulnerable path by invoking gzprintf() or gzvprintf() specifically after a write stall has occurred. This sequence triggers an unchecked memmove() operation that writes data beyond the boundaries of the internal input buffer. Exploitation of this flaw can lead to significant memory corruption and potentially allow for arbitrary code execution within the context of the application utilizing the compromised zlib library. Given the ubiquity of zlib as a core compression component in numerous software packages, the impact of this vulnerability is widespread.

Impact

Successful exploitation of CVE-2026-85091 allows for heap memory corruption, which can lead to application crashes or the execution of arbitrary code with the privileges of the affected process. This vulnerability affects any software relying on the specified versions of zlib for compression tasks, potentially exposing a wide range of enterprise applications and system-level utilities to remote or local code execution attacks.

Recommendation

Update all software dependencies that include zlib versions 1.3.1.2 through 1.3.2 to the latest patched version of the library. Security teams should identify applications utilizing these specific zlib versions through software composition analysis (SCA) or vulnerability scanning tools. There are no known signature-based network detections for this flaw, as it relies on specific library-level function interactions. Focus remediation efforts on patching the underlying library code via software package managers (e.g., APT, YUM, NuGet, npm).

]]>highadvisory