Log in Start free

Vulnerability · Published Jan 7, 2026 · Assigned by VulnCheck

CVE-2026-22184zlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname()

High 8.6

In plain English

A high-severity out-of-bounds write in zlib from zlib software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.4%top 64.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20zlib1.3.2-r0ALPINE-CVE-2026-22184
Alpine:v3.21zlib1.3.2-r0ALPINE-CVE-2026-22184
Alpine:v3.22zlib1.3.2-r0ALPINE-CVE-2026-22184
Alpine:v3.23zlib1.3.2-r0ALPINE-CVE-2026-22184
Alpine:v3.24zlib1.3.2-r0ALPINE-CVE-2026-22184
Debian:12zlib1:1.2.6.dfsg-1DEBIAN-CVE-2026-22184
Debian:13zlib1:1.2.6.dfsg-1DEBIAN-CVE-2026-22184
Debian:14zlib1:1.2.6.dfsg-1DEBIAN-CVE-2026-22184
Ubuntu:22.04:LTSzsyncno fix listedUBUNTU-CVE-2026-22184
Ubuntu:24.04:LTSzsyncno fix listedUBUNTU-CVE-2026-22184
Ubuntu:25.10zsyncno fix listedUBUNTU-CVE-2026-22184
Ubuntu:26.04:LTSzsyncno fix listedUBUNTU-CVE-2026-22184
Ubuntu:26.10zsyncno fix listedUBUNTU-CVE-2026-22184

Affected products (as reported)

VendorProductVersions
zlib software zlib 0 – through 1.3.1.2

Weakness: CWE-787, CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References