Vulnerability · Published Aug 24, 2026 · Assigned by VulnCheck

CVE-2026-76844zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

High 7.4

In plain English

A high-severity out-of-bounds write in zlib from zlib. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.6%top 51.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	zlib	no fix listed	DEBIAN-CVE-2026-76844
Debian:13	zlib	no fix listed	DEBIAN-CVE-2026-76844
Debian:14	zlib	1:1.3.dfsg+really1.3.2-4	DEBIAN-CVE-2026-76844
npm	webpack-dev-middleware	8.3.0	GHSA-g84c-rxfj-3j2c
npm	webpack-dev-middleware	7.4.6	GHSA-g84c-rxfj-3j2c

Affected products (as reported)

Vendor	Product	Versions
zlib	zlib	1.2.11 – through 1.3.2

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

References

Technical report and proof of concept technical-description, exploit
Patch Commit patch
https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393 technical-description
https://github.com/madler/zlib product
VulnCheck Advisory: zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate third-party-advisory