zlib EUVD-2026-70301

Exploitation requires that the target application uses zlib's non-blocking gzip write interface (gzprintf() or gzvprintf() in a context where O_NONBLOCK or equivalent non-blocking behavior is active), and that the attacker can induce a prior write stall that leaves an external buffer pointer stale before the subsequent gzprintf()/gzvprintf() call. Applications using only blocking gzwrite() or that do not call gzprintf()/gzvprintf() after a stall are not vulnerable to this specific path. The CVSS AC:H metric confirms the non-default, state-dependent trigger; this limits mass exploitation but does not prevent targeted attacks against known-vulnerable application patterns. No authentication is required from the attacker's perspective once network access to the vulnerable service exists.

The provided CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) scores 8.3, reflecting that exploitation requires navigating a specific application state - non-blocking mode plus a preceding write stall - but no authentication or user interaction once those conditions are met. AC:H is the principal risk-limiter: an attacker must be able to induce the stall state in the target application, which depends entirely on how the consuming application exposes the non-blocking gzip write path. zlib itself is ubiquitous, but only applications that use gzprintf()/gzvprintf() in non-blocking mode over attacker-influenced data are directly exploitable. No CISA KEV listing has been identified, and no EPSS data was provided; however, a public PoC gist exists (referenced via VulnCheck), which materially lowers the exploitation bar for targeted attack. The integrity and availability impacts are high (heap corruption can achieve code execution or crash), while confidentiality impact is nil (write-only primitive). Real-world exploitability is moderate-to-high for applications fitting the exposure profile; broad mass-exploitation is constrained by the AC:H pre-conditions.

An attacker sends a stream of data to a network-facing service that uses zlib's non-blocking gzip write API, deliberately pacing writes to induce a write stall and leave the external buffer pointer in a stale state. A subsequent call to gzprintf() triggers gz_vacate(), which performs an unchecked memmove() beyond the internal input buffer boundary, corrupting adjacent heap metadata. A public PoC demonstrating this sequence is available at the referenced GitHub gist.