Ruby zlib gem CVE-2026-27820

Exploitation requires that the target application uses Zlib::GzipReader (or a code path that invokes it) and calls ungetc - or an internal path that reaches zstream_buffer_ungets - with attacker-influenced data whose length, combined with previously buffered output, exceeds the backing Ruby String's allocated capacity. This is a non-default code path: standard sequential gzip decompression without ungetc calls is not affected. The CVSS 4.0 AT:P metric confirms that a specific attack prerequisite (heap capacity/state condition) must be met. Exploitation is limited to availability impact (process crash or memory corruption); no confidentiality or integrity compromise is indicated by any available scoring source. There is no authentication requirement to supply gzip data to a network-accessible service, but the application must expose a GzipReader ungetc code path to attacker-controlled input.

Signals are broadly consistent but point toward low real-world risk. The CVSS 4.0 base score of 1.7 reflects AV:N (network-reachable gzip input), AT:P (attack requirements present - the overflow requires the prepend length to exceed buffer capacity, a non-trivial heap-state condition), PR:N, UI:N, and impact limited to VA:L with no confidentiality or integrity impact. EPSS at 0.04% (13th percentile) and SSVC exploitation=none confirm no observed exploitation. SSVC automatable=yes suggests that once a triggering input is identified, it could be delivered at scale, but technical impact is rated only partial, which is consistent with the low-severity crash/instability outcome rather than code execution. The memory corruption is real and classified as CWE-120, but the practical outcome appears limited to availability (process crash or instability) rather than arbitrary code execution, based on all available scoring. No KEV listing and no public POC further reduce priority. For applications that pass untrusted gzip streams through GzipReader with ungetc, patching is still warranted given the memory-corruption class.

An attacker who can supply a crafted gzip-compressed payload to a Ruby application that decompresses it via Zlib::GzipReader and invokes ungetc with content sized to exceed the internal buffer's allocated capacity could trigger the out-of-bounds memmove, corrupting heap memory and causing the Ruby process to crash or behave unexpectedly. No public proof-of-concept exploit has been identified at the time of analysis. The AT:P requirement in the CVSS 4.0 vector indicates that a specific heap state condition must be satisfied for the overflow to occur, making reliable exploitation somewhat dependent on runtime memory layout.