CVE-Katalog

CVE-2026-85091

Schweregrad: High · CVSS 8.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Sep 2, 2026, 10:00:00 PM UTC
Updated: Sep 3, 2026, 1:06:20 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.36% · Oct 22, 2026

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	zlib	sid	`1:1.3.dfsg+really1.3.2-3`	vulnerable
Debian	zlib	forky	`1:1.3.dfsg+really1.3.2-3`	vulnerable
Debian	zlib	trixie	`1:1.3.dfsg+really1.3.1-1`	vulnerable
Debian	zlib	bookworm	`1:1.2.13.dfsg-1`	vulnerable
Alpine	zlib	3.21	`1.3.2-r1`	fixed
Alpine	zlib	3.22	`1.3.2-r1`	fixed
Alpine	zlib	3.23	`1.3.2-r1`	fixed
Alpine	zlib	3.24	`1.3.2-r1`	fixed
Ubuntu	klibc	pro	`2.0.6-1ubuntu1`	vulnerable
Ubuntu	klibc	pro	`2.0.6-1ubuntu2`	vulnerable
Ubuntu	klibc	pro	`2.0.7-1ubuntu1`	vulnerable
Ubuntu	klibc	pro	`2.0.7-1ubuntu3`	vulnerable
Ubuntu	klibc	pro	`2.0.7-1ubuntu4`	vulnerable
Ubuntu	klibc	pro	`2.0.7-1ubuntu5`	vulnerable
Ubuntu	klibc	pro	`2.0.7-1ubuntu5.1`	vulnerable
Ubuntu	klibc	pro	`2.0.7-1ubuntu5.2`	vulnerable
Ubuntu	klibc	pro	`2.0.7-1ubuntu5.2+esm1`	vulnerable
Ubuntu	rsync	pro	`3.1.3-6`	vulnerable
Ubuntu	rsync	pro	`3.1.3-8`	vulnerable
Ubuntu	rsync	pro	`3.1.3-8ubuntu0.1`	vulnerable
Ubuntu	rsync	pro	`3.1.3-8ubuntu0.2`	vulnerable
Ubuntu	rsync	pro	`3.1.3-8ubuntu0.3`	vulnerable
Ubuntu	rsync	pro	`3.1.3-8ubuntu0.4`	vulnerable
Ubuntu	rsync	pro	`3.1.3-8ubuntu0.5`	vulnerable
Ubuntu	rsync	pro	`3.1.3-8ubuntu0.7`	vulnerable
Ubuntu	rsync	pro	`3.1.3-8ubuntu0.8`	vulnerable
Ubuntu	rsync	pro	`3.1.3-8ubuntu0.9`	vulnerable
Ubuntu	rsync	pro	`3.1.3-8ubuntu0.9+esm1`	vulnerable
Ubuntu	rsync	pro	`3.1.3-8ubuntu0.9+esm2`	vulnerable
Ubuntu	zsync	16.04	`0.6.2-1ubuntu1`	vulnerable
Ubuntu	zsync	18.04	`0.6.2-2ubuntu1`	vulnerable
Ubuntu	zsync	18.04	`0.6.2-3ubuntu1`	vulnerable
Ubuntu	zsync	20.04	`0.6.2-3ubuntu1`	vulnerable
Ubuntu	klibc	22.04	`2.0.8-6.1ubuntu2`	vulnerable
Ubuntu	klibc	22.04	`2.0.10-3`	vulnerable
Ubuntu	klibc	22.04	`2.0.10-4`	vulnerable
Ubuntu	klibc	22.04	`2.0.10-4ubuntu0.1`	vulnerable
Ubuntu	klibc	22.04	`2.0.10-4ubuntu0.2`	vulnerable
Ubuntu	zsync	22.04	`0.6.2-3ubuntu1`	vulnerable
Ubuntu	klibc	24.04	`2.0.13-1`	vulnerable
Ubuntu	klibc	24.04	`2.0.13-2`	vulnerable
Ubuntu	klibc	24.04	`2.0.13-2ubuntu1`	vulnerable
Ubuntu	klibc	24.04	`2.0.13-4`	vulnerable
Ubuntu	klibc	24.04	`2.0.13-4ubuntu0.1`	vulnerable
Ubuntu	klibc	24.04	`2.0.13-4ubuntu0.2`	vulnerable
Ubuntu	zlib	24.04	`1:1.2.13.dfsg-1ubuntu5`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3ubuntu1`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3.1ubuntu1`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3.1ubuntu2`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3.1ubuntu2.1`	vulnerable
Ubuntu	zlib	24.04	`1:1.3.dfsg-3.1ubuntu2.2`	vulnerable
Ubuntu	zsync	24.04	`0.6.2-5`	vulnerable
Ubuntu	zsync	24.04	`0.6.2-5build1`	vulnerable
Ubuntu	klibc	26.10	`2.0.14-1ubuntu2`	vulnerable
Ubuntu	zlib	26.10	`1:1.3.dfsg+really1.3.1-1ubuntu3`	vulnerable
Ubuntu	zlib	26.10	`1:1.3.dfsg+really1.3.2-3ubuntu1`	vulnerable
Ubuntu	zsync	26.10	`0.6.2-9`	vulnerable
Ubuntu	zsync	26.10	`0.6.3-2`	vulnerable
Ubuntu	klibc	26.04	`2.0.14-1ubuntu1`	vulnerable
Ubuntu	klibc	26.04	`2.0.14-1ubuntu2`	vulnerable
Ubuntu	zlib	26.04	`1:1.3.dfsg+really1.3.1-1ubuntu2`	vulnerable
Ubuntu	zlib	26.04	`1:1.3.dfsg+really1.3.1-1ubuntu3`	vulnerable
Ubuntu	zlib	26.04	`1:1.3.dfsg+really1.3.1-1ubuntu3.1`	vulnerable
Ubuntu	zsync	26.04	`0.6.2-8`	vulnerable
Ubuntu	zsync	26.04	`0.6.2-9`	vulnerable
Ubuntu	zlib	noble	`1:1.3.dfsg-3.1ubuntu2.3`	fixed
Ubuntu	lib32z1	noble	`1:1.3.dfsg-3.1ubuntu2.3`	fixed
Ubuntu	lib32z1-dev	noble	`1:1.3.dfsg-3.1ubuntu2.3`	fixed
Ubuntu	lib64z1	noble	`1:1.3.dfsg-3.1ubuntu2.3`	fixed
Ubuntu	lib64z1-dev	noble	`1:1.3.dfsg-3.1ubuntu2.3`	fixed
Ubuntu	libminizip-dev	noble	`1:1.3.dfsg-3.1ubuntu2.3`	fixed
Ubuntu	libminizip1t64	noble	`1:1.3.dfsg-3.1ubuntu2.3`	fixed
Ubuntu	libx32z1	noble	`1:1.3.dfsg-3.1ubuntu2.3`	fixed
Ubuntu	libx32z1-dev	noble	`1:1.3.dfsg-3.1ubuntu2.3`	fixed
Ubuntu	minizip	noble	`1:1.3.dfsg-3.1ubuntu2.3`	fixed
Ubuntu	zlib1g	noble	`1:1.3.dfsg-3.1ubuntu2.3`	fixed
Ubuntu	zlib1g-dev	noble	`1:1.3.dfsg-3.1ubuntu2.3`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	zlib	source	sid	`(unfixed)`	not yet assigned	Not reported	[1146895]
Debian	zlib	source	forky	`(unfixed)`	not yet assigned	Not reported	[1146895]
Debian	zlib	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1146895]
Debian	zlib	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1146895]
Alpine	zlib	apk	3.21	`1.3.2-r1`	Not reported	ALPINE-CVE-2026-85091	Not reported
Alpine	zlib	apk	3.22	`1.3.2-r1`	Not reported	ALPINE-CVE-2026-85091	Not reported
Alpine	zlib	apk	3.23	`1.3.2-r1`	Not reported	ALPINE-CVE-2026-85091	Not reported
Alpine	zlib	apk	3.24	`1.3.2-r1`	Not reported	ALPINE-CVE-2026-85091	Not reported
Ubuntu	zlib	deb	noble	`1:1.3.dfsg-3.1ubuntu2.3`	Not reported	Not reported	Not reported
Ubuntu	lib32z1	deb	noble	`1:1.3.dfsg-3.1ubuntu2.3`	Not reported	Not reported	Not reported
Ubuntu	lib32z1-dev	deb	noble	`1:1.3.dfsg-3.1ubuntu2.3`	Not reported	Not reported	Not reported
Ubuntu	lib64z1	deb	noble	`1:1.3.dfsg-3.1ubuntu2.3`	Not reported	Not reported	Not reported
Ubuntu	lib64z1-dev	deb	noble	`1:1.3.dfsg-3.1ubuntu2.3`	Not reported	Not reported	Not reported
Ubuntu	libminizip-dev	deb	noble	`1:1.3.dfsg-3.1ubuntu2.3`	Not reported	Not reported	Not reported
Ubuntu	libminizip1t64	deb	noble	`1:1.3.dfsg-3.1ubuntu2.3`	Not reported	Not reported	Not reported
Ubuntu	libx32z1	deb	noble	`1:1.3.dfsg-3.1ubuntu2.3`	Not reported	Not reported	Not reported
Ubuntu	libx32z1-dev	deb	noble	`1:1.3.dfsg-3.1ubuntu2.3`	Not reported	Not reported	Not reported
Ubuntu	minizip	deb	noble	`1:1.3.dfsg-3.1ubuntu2.3`	Not reported	Not reported	Not reported
Ubuntu	zlib1g	deb	noble	`1:1.3.dfsg-3.1ubuntu2.3`	Not reported	Not reported	Not reported
Ubuntu	zlib1g-dev	deb	noble	`1:1.3.dfsg-3.1ubuntu2.3`	Not reported	Not reported	Not reported

[Debian bug #1146895]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[lib32z1]Betroffen
Quellpaket: [zlib]
Details (1)
- 1:1.2.13.dfsg-1 · amd64 · bookworm
  Betroffen
  nvd · zlib · debian · bookworm; nvd · zlib · debian · 12
[lib32z1-dev]Betroffen
Quellpaket: [zlib]
Details (1)
- 1:1.2.13.dfsg-1 · amd64 · bookworm
  Betroffen
  nvd · zlib · debian · bookworm; nvd · zlib · debian · 12
[zlib1g]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.2.13.dfsg-1 · amd64 · bookworm
  Betroffen
  nvd · zlib · debian · bookworm; nvd · zlib · debian · 12
- 1:1.2.13.dfsg-1 · arm64 · bookworm
  Betroffen
  nvd · zlib · debian · bookworm; nvd · zlib · debian · 12
[zlib1g-dev]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.2.13.dfsg-1 · amd64 · bookworm
  Betroffen
  nvd · zlib · debian · bookworm; nvd · zlib · debian · 12
- 1:1.2.13.dfsg-1 · arm64 · bookworm
  Betroffen
  nvd · zlib · debian · bookworm; nvd · zlib · debian · 12

[Debian 13 (Trixie)]

[lib32z1]Betroffen
Quellpaket: [zlib]
Details (1)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  nvd · zlib · debian · 13
[lib32z1-dev]Betroffen
Quellpaket: [zlib]
Details (1)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  nvd · zlib · debian · 13
[libminizip1t64]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  nvd · zlib · debian · 13
- 1:1.3.dfsg+really1.3.1-1+b1 · arm64 · trixie
  Betroffen
  nvd · zlib · debian · 13
[libminizip-dev]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  nvd · zlib · debian · 13
- 1:1.3.dfsg+really1.3.1-1+b1 · arm64 · trixie
  Betroffen
  nvd · zlib · debian · 13
[minizip]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  nvd · zlib · debian · 13
- 1:1.3.dfsg+really1.3.1-1+b1 · arm64 · trixie
  Betroffen
  nvd · zlib · debian · 13
[zlib1g]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  nvd · zlib · debian · 13
- 1:1.3.dfsg+really1.3.1-1+b1 · arm64 · trixie
  Betroffen
  nvd · zlib · debian · 13
[zlib1g-dev]Betroffen
Quellpaket: [zlib]
Details (2)
- 1:1.3.dfsg+really1.3.1-1+b1 · amd64 · trixie
  Betroffen
  nvd · zlib · debian · 13
- 1:1.3.dfsg+really1.3.1-1+b1 · arm64 · trixie
  Betroffen
  nvd · zlib · debian · 13

Beobachtet: Oct 24, 2026, 4:12:27 AM UTC

Referenzen

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]