CVE-2026-24800
Buffer Overflow in Tildearrow Furnace's inflate.C (zlib) Module
Publication date: 2026-01-27
Last updated on: 2026-01-27
Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tildearrow | furnace | From 2025-04-28 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a classic buffer overflow caused by an out-of-bounds write in the inflate() function used for decompressing gzip data in the tildearrow furnace project. The issue originated because the inflate() function, cloned from the zlib library, did not include a critical security patch that fixed how the gzip header extra field is handled during decompression. This flaw could lead to writing data outside the intended buffer boundaries, potentially causing crashes or allowing an attacker to execute arbitrary code. [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including application crashes, denial of service, or potentially arbitrary code execution if exploited. Since the inflate() function is used to decompress gzip data, an attacker could craft malicious compressed data that triggers the buffer overflow, compromising the security and stability of any system using the affected tildearrow furnace library. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the tildearrow furnace library to include the security patch that fixes the inflate() function's handling of the gzip header extra field. This patch, originally applied to the zlib library and merged into furnace in pull request #2471, corrects the out-of-bounds write issue. Applying this update will eliminate the security flaw. [1]