{"id":"CVE-2026-76844","summary":"zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write","details":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.","aliases":["GHSA-g84c-rxfj-3j2c"],"modified":"2026-10-14T07:10:13.987410538Z","published":"2026-08-24T13:12:01.148Z","database_specific":{"cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76844.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76844.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76844"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"},{"type":"FIX","url":"https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148"},{"type":"PACKAGE","url":"https://github.com/madler/zlib"},{"type":"ARTICLE","url":"https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393"},{"type":"EVIDENCE","url":"https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/madler/zlib","events":[{"introduced":"cacf7f1d4e3d44d871b605da3b647f07d718623f"},{"fixed":"da607da739fa6047df13e66a2af6b8bec7c2a498"},{"introduced":"0"},{"fixed":"570720b0c24f9686c33f35a1b3165c1f568b96be"},{"fixed":"df84af25dc1942490e1d1c899a07619152a46148"}],"database_specific":{"extracted_events":[{"introduced":"1.2.11"},{"fixed":"1.3.2"},{"introduced":"0"},{"fixed":"1.3.1.2"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v1.3.1","v1.3","v1.2.13","v1.2.12","v1.2.11"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/madler/zlib/commit/570720b0c24f9686c33f35a1b3165c1f568b96be","target":{"file":"deflate.c"},"deprecated":false,"digest":{"line_hashes":["94557474100807838653100501376880416687","241993643407371955548973125798057698501","179268733966957879736352493294299716250"],"threshold":0.9},"id":"CVE-2026-76844-4d0e32f4","signature_type":"Line"},{"digest":{"threshold":0.9,"line_hashes":["298256010342233320403953179587420994486","304753402722452017931396826415910899197","84890611830550294116388123009164973797","305294332451176924101710687848488803236","34733096881164427775731547611031468195","10421832822737839981063407933824629570","73549419877660507543226264114412419782","171979836933231787876038708310648451405"]},"id":"CVE-2026-76844-72376cc3","signature_type":"Line","signature_version":"v1","source":"https://github.com/madler/zlib/commit/570720b0c24f9686c33f35a1b3165c1f568b96be","target":{"file":"contrib/infback9/inftree9.c"},"deprecated":false},{"digest":{"line_hashes":["281075721717734810581220934387571625225","169437545400660320693512107130534053848","19892860309634490294703178019729848088","180763229905933804546063935939196182799","124519007697485423212978743618328545779","99776724811319399235429816708145432758","91098846152240227901045382792730484372","78880879027778696886178205518335749323"],"threshold":0.9},"id":"CVE-2026-76844-c47f859a","signature_type":"Line","signature_version":"v1","source":"https://github.com/madler/zlib/commit/570720b0c24f9686c33f35a1b3165c1f568b96be","target":{"file":"inftrees.c"},"deprecated":false},{"source":"https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148","target":{"file":"gzwrite.c"},"deprecated":false,"digest":{"line_hashes":["321090108084038968139662894088929200997","2390431503662171455844889591158512276","135295985711956928995159240810902034005","87796769545444147572130438046479323601","235441658041769278382234619656069783544"],"threshold":0.9},"id":"CVE-2026-76844-d61a29f0","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"263750299263033607512351826485480615201","length":1343},"id":"CVE-2026-76844-dc9ae361","signature_type":"Function","signature_version":"v1","source":"https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148","target":{"file":"gzwrite.c","function":"gz_write"}}],"vanir_signatures_modified":"2026-10-14T07:10:13Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76844.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}]}