Skip to main content

Zlib CVE-2026-22184

MEDIUM
Out-of-bounds Write (CWE-787)
2026-01-07 disclosure@vulncheck.com
Buffer Overflow Memory Corruption Zlib
4.6
CVSS 4.0 · Vendor: vulncheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Supply excessively long archive name to untgz
  2. Exploit
    Overflow fixed-size global buffer
  3. Execution
    Write arbitrary data to memory
  4. Impact
    Execute code with user privileges

Vulnerability Assessment

Weakness
CWE
CWE-787
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Local user account required to execute untgz utility with maliciously crafted command-line argument. Vulnerability exists only in contrib/untgz demonstration tool in zlib versions ≤1.3.1.2; core zlib library unaffected.
Impact

CVSS 9.8 (CRITICAL). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None.
Exploit ScenarioDerived

An attacker could exploit this flaw, an out-of-bounds write in a fixed-size global buffer.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Local privilege escalation in zlib 1.3.1.2 and earlier allows authenticated users to achieve arbitrary code execution through a buffer overflow in the contrib/untgz utility when processing command-line arguments with excessively long archive names. The vulnerability affects only the standalone untgz demonstration tool and does not impact the core zlib library. No patch is currently available.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54 CVSS 7.8

zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. [CVSS 9.8 CRITICAL]

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-787 (Out-of-bounds Write). Affects Zlib. zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.

Know when Zlib gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vulncheck) PRIMARY 4.6 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 8.6 HIGH

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
Active
Vulnerable system: Confidentiality
Low
Vulnerable system: Integrity
None
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

4
Severity Changed
Jun 30, 2026 - 03:23 NVD
HIGH MEDIUM
CVSS changed
Jun 30, 2026 - 03:23 NVD
7.8 (HIGH) 4.6 (MEDIUM)
Patch released
Apr 09, 2026 - 14:30 nvd
Patch available
CVE Published
Jan 07, 2026 - 21:16 nvd
HIGH 7.8

DescriptionCVE.org

zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.

Executive ViewAI

Why It Matters

CVE-2026-22184 presents notable security risk, a out-of-bounds write vulnerability rated CVSS 7.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.

Threat Intelligence Overview

EPSS Score
0.0%
Top 87% exploitable
Threat Intel
1
1 sources
Data Quality
7 sources
Confidence: High
NVD CVE.org EPSS CISA MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

33
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +23
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Affected Products (CPE)CVE.org

cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*

More in Zlib

View all
CVE-2022-37434 CRITICAL POC
9.8 Aug 05

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
CVE-2016-9841 CRITICAL
9.8 May 23

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointe
CVE-2016-9843 CRITICAL
9.8 May 23

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via v
CVE-2016-9840 HIGH
8.8 May 23

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper point
CVE-2026-85091 HIGH POC
8.3 Sep 03

Heap buffer overflow in zlib 1.3.1.2 through 1.3.2 allows remote attackers to corrupt memory via crafted input to applic
CVE-2023-45853 CRITICAL
9.8 Oct 14

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64

CVE-2016-9842 HIGH
8.8 May 23

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact v
CVE-2015-1191 MEDIUM POC
5.0 Jan 21

Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1)

CVE-2026-27171 LOW POC
2.9 Feb 18

zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts
CVE-2013-0296 MEDIUM
4.4 Apr 27

Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that

CVE-2023-6992 MEDIUM
4.0 Jan 04

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algori
CVE-2026-27820 LOW
1.7 Apr 16

Buffer overflow in the Ruby zlib gem's Zlib::GzipReader allows remote or local attackers supplying crafted gzip data to

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-202-06
Sources: CISA (public domain), Microsoft MSRC

References

Advisories & patches
ADVISORY https://vuldb.com/?id.339922 REF https://access.redhat.com/security/cve/CVE-2026-22184 REF https://bugzilla.redhat.com/show_bug.cgi?id=2427688 REF https://cert-portal.siemens.com/productcert/html/ssa-470355.html REF https://github.com/madler/zlib REF https://github.com/madler/zlib/issues/1142 REF https://seclists.org/fulldisclosure/2026/Jan/3 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22184.json REF https://www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfname REF https://zlib.net/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy