zlib's gz_vacate overflows a heap buffer after a stalled gzwrite
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
- Advisory
- CVE-2026-85091
- Library
- zlib, zlib on Debian
- Published
- Severity
- not scored upstream
- Affected
- zlib 1.3.1.2 through 1.3.2
- Fixed in
- see the upstream record
- Reaches you
- on a save path
What triggers it
Calling gzprintf or gzvprintf after a non-blocking gzwrite stalled.
What sillybos does
Not reached by opening a file
Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.
In zlib's gz file layer (gzwrite, gzprintf), on a non-blocking descriptor whose write stalled. No image file is the input, and nothing in the image stack calls that layer: libpng and libtiff use the raw deflate stream, Pillow's wheel references none of the gz write functions, and Python's zlib module has no gz API. Only a program that writes .gz files through zlib's own file functions, on a non-blocking descriptor, is in the path.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Checked on 2026-11-03 that nothing in the image stack calls zlib's gz write layer.
How to protect yourself
In general. Upgrade zlib to a version that has the fix; the upstream record names it.
Specifically. Not reached through an image: only a program's own gzwrite on a non-blocking descriptor; upgrade zlib.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/DEBIAN-CVE-2026-85091
- The record entry, triaged 2026-11-03, last checked 2026-11-03