CVE-2026-85091— zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate
Quick assessment
Affected
zlib zlib
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
zlib 1.3.1.2 到 1.3.2 版本中的 函数存在堆缓冲区溢出漏洞，该漏洞在处理使用了过期外部缓冲区指针的非阻塞 操作时发生。攻击者可以在写入阻塞（write stall）之后调用 或 来触发该溢出，由于未对 进行边界检查，导致数据写入超出了内部输入缓冲区的范围。
Possible ATT&CK Techniques 2 AI
T1041 · Exfiltration Over C2 Channel T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85091
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate
Source: CVE Program / CVE List V5
Vulnerability Description
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-85091
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85091
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-85091 (1)
Vendor Advisories for CVE-2026-85091 (1)
Proof of Concept for CVE-2026-85091 (1)
-
🔗 zlib gz_vacate() Heap-Buffer Overflow via Non-Blocking Write · GitHub Read full article technical-description exploit
Vendor Pages for CVE-2026-85091 (1)
IV. Related Vulnerabilities
Same vendor: zlib
Same weakness: CWE-787
-
CVE-2026-85084
Out-of-bounds write in TizenFX MediaBufferBase indexer sette -
CVE-2026-84698
PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size -
CVE-2025-12768
FactoryTalk® Historian Machine Edition - Out-of-Bounds Write -
CVE-2026-13732
Gdb: gdb: out-of-bounds write in stabs parser read_member_fu -
CVE-2026-14368
Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON stri
V. Comments for CVE-2026-85091
No comments yet