Heap Buffer Overflow in zlib gz_vacate() Function

Executive Summary

CVE-2026-85091 is a heap buffer overflow in zlib versions 1.3.1.2 through 1.3.2 affecting the gz_vacate() function. It occurs during non-blocking gzwrite() operations when stale external buffer pointers are present. Attackers exploit this by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check your zlib version with 'zlib-config --version' or 'dpkg -l | grep zlib'. If using 1.3.1.2 through 1.3.2, the system is vulnerable. Monitor applications using gzprintf() or gzvprintf() with non-blocking writes for crashes or memory corruption.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to crashes, data corruption, or potentially arbitrary code execution if heap memory is overwritten. It requires specific conditions like non-blocking file descriptors and large writes followed by gzprintf() calls. The impact depends on the application's heap layout and memory allocator.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade zlib to a patched version immediately. If upgrading is not possible, disable non-blocking gzip writes in applications or avoid using gzprintf() and gzvprintf() after write stalls. Apply strict input validation for gzip operations.

Useful 0 Not Useful 0