CVE-2026-76844

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-76844
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76844.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-76844
Aliases
Downstream
AZL (1)
CGA (38)
CLSA (24)
DEBIAN (1)
ECHO (1)
MINI (6)
ROOT (1)
Published
2026-08-24T13:12:01Z
Modified
2026-10-28T11:17:48Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write
Details

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76844.json"
}
References

Affected packages

Git / github.com/madler/zlib

Affected ranges

Type
GIT
Repo
https://github.com/madler/zlib
Events
Introduced
cacf7f1d4e3d44d871b605da3b647f07d718623f
Fixed
df84af25dc1942490e1d1c899a07619152a46148
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.2.11"
                },
                {
                    "last_affected": "1.3.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "df84af25dc1942490e1d1c899a07619152a46148"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v1.*
v1.2.11
v1.2.12
v1.2.13
v1.3
v1.3.1
v1.3.1.2
v1.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76844.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "321090108084038968139662894088929200997",
                "2390431503662171455844889591158512276",
                "135295985711956928995159240810902034005",
                "87796769545444147572130438046479323601",
                "235441658041769278382234619656069783544"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-76844-d61a29f0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148",
        "target": {
            "file": "gzwrite.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "263750299263033607512351826485480615201",
            "length": 1343
        },
        "id": "CVE-2026-76844-dc9ae361",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148",
        "target": {
            "file": "gzwrite.c",
            "function": "gz_write"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:17:48Z"