Description

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-03T13:06:20.573Z",
  "pubdate": "2026-09-03T13:06:20.573Z",
  "executiveSummary": "This vulnerability is a heap-based buffer overflow residing within the zlib compression library, specifically affecting versions 1.3.1.2 through 1.3.2. The flaw exists in the gz_vacate() function, which handles memory management during buffered write operations.\nThe vulnerability is triggered during non-blocking gzwrite() operations when external buffer pointers become stale. By manipulating the execution flow via gzprintf() or gzvprintf() following a write stall, an attacker can induce an out-of-bounds memory write.\nSuccessful exploitation of this flaw can lead to memory corruption, potential arbitrary code execution, or denial-of-service conditions within the affected application. Because zlib is a foundational library utilized across numerous software ecosystems, the risk implications are significant.\nExploitation requires the attacker to influence the application's input handling to trigger a stall condition followed by the specific calling of printf-style write functions. No specific authentication or privilege escalation is explicitly required, provided the attacker can interact with the vulnerable application's zlib-based stream processing.",
  "technicalDetails": "The vulnerability is rooted in a flawed state management mechanism within the gz_vacate() function in zlib versions 1.3.1.2 to 1.3.2. This function is responsible for managing the internal buffer of the gzip stream when data needs to be vacated to accommodate new input.\nIn the context of non-blocking I/O, gzwrite() operations may stall if the underlying transport is unable to accept further data immediately. During such a stall, if the state of the internal buffers and external pointers becomes inconsistent, the library fails to properly track the boundaries of the memory region being manipulated.\nThe attack vector involves the use of gzprintf() or gzvprintf(). These functions rely on internal zlib mechanisms to format and write data to the stream. When an application attempts to write data after a previous write has stalled, the library may incorrectly calculate the available space in the internal input buffer. This calculation error persists because the external buffer pointers, which were intended to be temporary, are treated as valid despite having become stale during the stall.\nWhen the memory movement logic is triggered, the library performs a memmove() operation using parameters derived from the stale pointers. Since the boundary checks are bypassed or incorrectly computed, the memmove() proceeds to write data outside the allocated heap buffer boundaries.\nThe attack flow proceeds as follows: First, the attacker initiates a write operation to a zlib stream that triggers a block or delay in output processing. Second, the attacker invokes gzprintf() or gzvprintf(). Because the buffer state was not safely cleaned or reconciled following the initial stall, the library uses stale pointer arithmetic to define the destination for the memmove() operation. Third, the memmove() executes, overwriting adjacent heap memory with attacker-controlled content. This heap corruption can be leveraged to manipulate function pointers, object vtables, or other critical process data structures, potentially facilitating arbitrary code execution.\nThe impact is heavily dependent on the memory layout of the host process and the specific heap management implementation. Given the widespread reliance on zlib for data compression in network protocols, file formats, and system utilities, this vulnerability presents a critical risk to process integrity."
}