CVE-2026-76844

What it is

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data tampering, service disruption.

Exploit odds

0.6% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-24 14:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-12 17:10 UTC Last updatedMost recent change to the record

Details

Published

2026-08-24 14:17 UTC

Last modified

2026-10-12 17:10 UTC

Exploit probability

0.6% · EPSS, next 30 days

Weakness

CWE-787 · Out-of-bounds write

Record status

Deferred

Attack profile CVSS 4.0 · 8.3

Attack vector

Network

Complexity

High

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

None

Integrity

High

Availability

High