Skip to content

CVE-2002-0059

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and...

9.8 Critical

CVE-2002-0059 is a critical vulnerability (CVSS 9.8) in Zlib, published March 15, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.69%, the 95th percentile. No source names a fixed version.

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

9.69%Down 2.6 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.

Record: CVE-2002-0059
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-415
Updated: 2026-11-02

CVE List No score

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.

Record: CVE-2002-0059
Updated: 2026-11-02

EUVDEUVD-2002-0059 No score

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.

Record: EUVD-2002-0059
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8894-p74v-5485 No score

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and...

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.

Record: GHSA-8894-p74v-5485
Updated: 2026-11-02

Affected products

zlib

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD

References

Show 11 moreShow less