{"id":"CVE-2026-85091","aliases":["ALPINE-CVE-2026-85091","AZL-99090","AZL-99174","AZL-99234","AZL-99276","AZL-99294","BELL-CVE-2026-85091","DEBIAN-CVE-2026-85091","EUVD-2026-70301","GHSA-g5fp-32jq-cfw2","ROOT-OS-ALPINE-320-CVE-2026-85091","ROOT-OS-ALPINE-321-CVE-2026-85091","ROOT-OS-ALPINE-322-CVE-2026-85091","ROOT-OS-ALPINE-323-CVE-2026-85091","ROOT-OS-ALPINE-324-CVE-2026-85091","ROOT-OS-DEBIAN-12-CVE-2026-85091","UBUNTU-CVE-2026-85091","USN-8954-1","openSUSE-SU-2026:12206-1"],"status":"published","title":"zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00469,"percentile":0.41011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-09-03T01:04:44Z","modified":"2026-11-11T09:41:11Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"zlib","fixed_in":["1.3.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"zlib","fixed_in":["1.3.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"zlib","fixed_in":["1.3.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"zlib","fixed_in":["1.3.2-r1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"zlib","fixed_in":["1.3.2-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"zlib","fixed_in":["1.3.2-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"zlib","fixed_in":["1.3.2-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"zlib","fixed_in":["1.3.2-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"zlib","fixed_in":["1.3.2-r1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zlib","fixed_in":["1:1.3.dfsg+really1.3.1-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zlib","fixed_in":["1:1.3.dfsg+really1.3.2-4"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"zlib","fixed_in":["1.3.2-r00071","1.3.2-r00072"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-zlib","fixed_in":["1.3.2-r00071","1.3.2-r00072"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"zlib","fixed_in":["1:1.2.13.dfsg-1.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-zlib","fixed_in":["1:1.2.13.dfsg-1.aikido.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"zlib","fixed_in":["1:1.3.dfsg-3.1ubuntu2.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"zlib","fixed_in":["1:1.3.dfsg+really1.3.2-3ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"zlib","fixed_in":["1:1.3.dfsg+really1.3.1-1ubuntu3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cloud-hypervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"52.0.152-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.0.kata1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"10.11.18-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.0.46-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.1-r2"},{"fixed":"1.3.2-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.1-r0"},{"fixed":"1.3.2-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.1-r2"},{"fixed":"1.3.2-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.1-r0"},{"fixed":"1.3.2-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.2.13.dfsg-1","1:1.2.13.dfsg-2","1:1.2.13.dfsg-3","1:1.3.dfsg+really1.3.1-1","1:1.3.dfsg+really1.3.1-2","1:1.3.dfsg+really1.3.1-3","1:1.3.dfsg+really1.3.2-1","1:1.3.dfsg+really1.3.2-2","1:1.3.dfsg+really1.3.2-3","1:1.3.dfsg+really1.3.2-4","1:1.3.dfsg-1","1:1.3.dfsg-2","1:1.3.dfsg-3","1:1.3.dfsg-3.1","1:1.3.dfsg-3.1~exp1"]},{"source":"osv","ecosystem":"Debian:13","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.dfsg+really1.3.1-1+deb13u1"}]}],"versions":["1:1.3.dfsg+really1.3.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.dfsg+really1.3.2-4"}]}],"versions":["1:1.3.dfsg+really1.3.1-1","1:1.3.dfsg+really1.3.1-2","1:1.3.dfsg+really1.3.1-3","1:1.3.dfsg+really1.3.2-1","1:1.3.dfsg+really1.3.2-2","1:1.3.dfsg+really1.3.2-3"]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r00071"},{"fixed":"1.3.2-r00072"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r00071"},{"fixed":"1.3.2-r00072"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.13.dfsg-1.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2.13.dfsg-1.aikido.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"klibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-3.1ubuntu2","2.0.2-1ubuntu1","2.0.2-1ubuntu2","2.0.3-0ubuntu1","2.0.3-0ubuntu1.14.04.1","2.0.3-0ubuntu1.14.04.2","2.0.3-0ubuntu1.14.04.3","2.0.3-0ubuntu1.14.04.3+esm2","2.0.3-0ubuntu1.14.04.3+esm3","2.0.3-0ubuntu1.14.04.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.2.8.dfsg-1ubuntu1","1:1.2.8.dfsg-1ubuntu1.1","1:1.2.8.dfsg-1ubuntu1.1+esm1","1:1.2.8.dfsg-1ubuntu1.1+esm2","1:1.2.8.dfsg-1ubuntu1.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"klibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.3-0ubuntu1","2.0.4-4","2.0.4-6","2.0.4-7","2.0.4-8","2.0.4-8ubuntu1","2.0.4-8ubuntu1.16.04.1","2.0.4-8ubuntu1.16.04.2","2.0.4-8ubuntu1.16.04.3","2.0.4-8ubuntu1.16.04.4","2.0.4-8ubuntu1.16.04.4+esm1","2.0.4-8ubuntu1.16.04.4+esm2","2.0.4-8ubuntu1.16.04.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-3ubuntu1.1","3.1.1-3ubuntu1.2","3.1.1-3ubuntu1.3","3.1.1-3ubuntu1.3+esm1","3.1.1-3ubuntu1.3+esm2","3.1.1-3ubuntu1.3+esm3","3.1.1-3ubuntu1.3+esm4","3.1.1-3ubuntu1.3+esm5","3.1.1-3ubuntu1.3+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"klibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.4-9ubuntu1","2.0.4-9ubuntu2","2.0.4-9ubuntu2.1","2.0.4-9ubuntu2.2","2.0.4-9ubuntu2.2+esm1","2.0.4-9ubuntu2.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-2","3.1.2-2.1","3.1.2-2.1ubuntu1","3.1.2-2.1ubuntu1.1","3.1.2-2.1ubuntu1.2","3.1.2-2.1ubuntu1.3","3.1.2-2.1ubuntu1.4","3.1.2-2.1ubuntu1.5","3.1.2-2.1ubuntu1.6","3.1.2-2.1ubuntu1.6+esm1","3.1.2-2.1ubuntu1.6+esm2","3.1.2-2.1ubuntu1.6+esm3","3.1.2-2.1ubuntu1.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"klibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.6-1ubuntu1","2.0.6-1ubuntu2","2.0.7-1ubuntu1","2.0.7-1ubuntu3","2.0.7-1ubuntu4","2.0.7-1ubuntu5","2.0.7-1ubuntu5.1","2.0.7-1ubuntu5.2","2.0.7-1ubuntu5.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.3-6","3.1.3-8","3.1.3-8ubuntu0.1","3.1.3-8ubuntu0.2","3.1.3-8ubuntu0.3","3.1.3-8ubuntu0.4","3.1.3-8ubuntu0.5","3.1.3-8ubuntu0.7","3.1.3-8ubuntu0.8","3.1.3-8ubuntu0.9","3.1.3-8ubuntu0.9+esm1","3.1.3-8ubuntu0.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"zsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.2-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.dfsg-3.1ubuntu2.3"}]}],"versions":["1:1.2.13.dfsg-1ubuntu5","1:1.3.dfsg-3ubuntu1","1:1.3.dfsg-3.1ubuntu1","1:1.3.dfsg-3.1ubuntu2","1:1.3.dfsg-3.1ubuntu2.1","1:1.3.dfsg-3.1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"klibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.14-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.dfsg+really1.3.2-3ubuntu1.1"}]}],"versions":["1:1.3.dfsg+really1.3.1-1ubuntu3","1:1.3.dfsg+really1.3.2-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.2-9","0.6.3-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.dfsg+really1.3.1-1ubuntu3.2"}]}],"versions":["1:1.3.dfsg+really1.3.1-1ubuntu2","1:1.3.dfsg+really1.3.1-1ubuntu3","1:1.3.dfsg+really1.3.1-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.dfsg-3.1ubuntu2.3"}]}],"versions":["1:1.2.13.dfsg-1ubuntu5","1:1.3.dfsg-3ubuntu1","1:1.3.dfsg-3.1ubuntu1","1:1.3.dfsg-3.1ubuntu2","1:1.3.dfsg-3.1ubuntu2.1","1:1.3.dfsg-3.1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.dfsg+really1.3.2-3ubuntu1.1"}]}],"versions":["1:1.3.dfsg+really1.3.1-1ubuntu3","1:1.3.dfsg+really1.3.2-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.dfsg+really1.3.1-1ubuntu3.2"}]}],"versions":["1:1.3.dfsg+really1.3.1-1ubuntu2","1:1.3.dfsg+really1.3.1-1ubuntu3","1:1.3.dfsg+really1.3.1-1ubuntu3.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"ruby","product":"zlib"},{"vendor":"zlib","product":"zlib"}],"references":[{"url":"https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","tags":["technical-description","exploit","evidence","report"]},{"url":"https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","tags":["technical-description","article"]},{"url":"https://github.com/madler/zlib","tags":["product","package"]},{"url":"https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-g5fp-32jq-cfw2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-85091","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-85091","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85091.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-85091","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-85091","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85091","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8954-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85091","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-85091","title":"zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T01:04:44.46Z","modified":"2026-09-03T13:21:30.355Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:19:52.410665Z"}],"euvd":[{"id":"EUVD-2026-70301","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T01:04:44Z","modified":"2026-09-03T13:21:30Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:14.198061Z"}],"ghsa":[{"id":"GHSA-g5fp-32jq-cfw2","title":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate...","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T15:32:17Z","modified":"2026-09-03T15:32:24Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:11:19.170234Z"}],"nvd":[{"id":"CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T13:06:20.573Z","modified":"2026-09-09T20:41:07.123Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:43.399612Z"}],"osv":[{"id":"ALPINE-CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T13:06:20.573Z","modified":"2026-10-06T21:30:02.437029614Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-85091","status":"published","published":"2026-09-08T06:05:21.356701Z","modified":"2026-10-02T07:15:04.817760671Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:26.341144Z"},{"id":"CVE-2026-85091","title":"zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T01:04:44.46Z","modified":"2026-10-28T02:30:40.472495269Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T13:06:20.573Z","modified":"2026-11-07T11:00:12.37538125Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-07T11:15:14.449016Z"},{"id":"UBUNTU-CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T13:06:00Z","modified":"2026-11-11T09:41:11.686197331Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"high"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-11T10:03:16.170826Z"},{"id":"AZL-99090","title":"CVE-2026-85091 affecting package zlib for versions less than 1.3.2-2","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T13:06:20Z","modified":"2026-11-07T14:20:35.986843852Z","updated_at":"2026-11-07T14:48:11.583685Z"},{"id":"AZL-99174","title":"CVE-2026-85091 affecting package cloud-hypervisor 52.0.152-1","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T13:06:20Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99234","title":"CVE-2026-85091 affecting package kata-containers 4.1.0.kata1-2","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T13:06:20Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.480138Z"},{"id":"AZL-99276","title":"CVE-2026-85091 affecting package mariadb 10.11.18-1","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T13:06:20Z","modified":"2026-09-08T05:27:28Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"AZL-99294","title":"CVE-2026-85091 affecting package mysql 8.0.46-1","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.","status":"published","published":"2026-09-03T13:06:20Z","modified":"2026-09-08T05:27:28Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"openSUSE-SU-2026:12206-1","title":"trivy-0.76.0-1.1 on GA media","description":"These are all security issues fixed in the trivy-0.76.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-21T17:23:14.152622324Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2026-85091","title":"CVE-2026-85091 in zlib - Patched by Root","description":"Root has patched CVE-2026-85091 in the zlib package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T10:48:31Z","modified":"2026-09-29T11:15:02.832895602Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-321-CVE-2026-85091","title":"CVE-2026-85091 in zlib - Patched by Root","description":"Root has patched CVE-2026-85091 in the zlib package for Root:Alpine:3.21. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-29T09:29:59Z","modified":"2026-10-08T13:00:07.234137496Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-322-CVE-2026-85091","title":"CVE-2026-85091 in zlib - Patched by Root","description":"Root has patched CVE-2026-85091 in the zlib package for Root:Alpine:3.22. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-29T09:48:10Z","modified":"2026-10-08T13:00:07.237850025Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-323-CVE-2026-85091","title":"CVE-2026-85091 in zlib - Patched by Root","description":"Root has patched CVE-2026-85091 in the zlib package for Root:Alpine:3.23. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-29T08:19:36Z","modified":"2026-10-08T13:00:07.242427382Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-ALPINE-324-CVE-2026-85091","title":"CVE-2026-85091 in zlib - Patched by Root","description":"Root has patched CVE-2026-85091 in the zlib package for Root:Alpine:3.24. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-29T09:27:25Z","modified":"2026-10-08T13:00:07.239028931Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-85091","title":"CVE-2026-85091 in zlib - Patched by Root","description":"Root has patched CVE-2026-85091 in the zlib package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-09T14:28:45Z","modified":"2026-09-09T15:15:03.610639587Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"USN-8954-1","title":"zlib vulnerability","description":"Ali Firas discovered that zlib incorrectly handled certain non-blocking\nwrite operations. An attacker could possibly use this issue to trigger a\nheap buffer overflow, resulting in a denial of service or arbitrary code\nexecution.","status":"published","published":"2026-10-22T19:54:53Z","modified":"2026-10-23T04:58:08.237439926Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}