CVE-2026-27820

Analyzed Analyzed - Analysis Complete

Buffer Overflow in zlib Ruby GzipReader Causes Memory Corruption

Publication date: 2026-04-16

Last updated on: 2026-05-21

Assigner: GitHub, Inc.

Description

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-16

Last Modified

2026-05-21

Generated

2026-07-06

AI Q&A

2026-04-16

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27820

EUVD

EUVD-2026-23278

Affected Vendors & Products

Vendor	Product	Version / Range
ruby-lang	zlib	to 3.0.1 (exc)
ruby-lang	zlib	From 3.1.0 (inc) to 3.1.2 (exc)
ruby-lang	zlib	From 3.2.0 (inc) to 3.2.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the zlib Ruby interface, specifically in the Zlib::GzipReader component. Certain versions of zlib (3.0.0 and below, 3.1.0, 3.1.1, 3.2.0, and 3.2.1) have a buffer overflow issue caused by the zstream_buffer_ungets function. This function attempts to prepend bytes provided by the caller before previously produced output but does not ensure that the underlying Ruby string has enough capacity before shifting existing data. As a result, if the buffer length exceeds its capacity, memory corruption can occur.

The vulnerability has been fixed in versions 3.0.1, 3.1.2, and 3.2.3.

Impact Analysis

This buffer overflow vulnerability can lead to memory corruption when processing compressed data using the affected zlib versions. Memory corruption may cause application crashes, unexpected behavior, or potentially allow an attacker to execute arbitrary code or cause denial of service, depending on how the corrupted memory is exploited.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the zlib Ruby interface to a fixed version. Specifically, update to versions 3.0.1, 3.1.2, or 3.2.3 or later, as these versions contain the fix for the buffer overflow issue in Zlib::GzipReader.

Hi! I’m here to help you understand CVE-2026-27820. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70