CVE-2026-76844

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-76844
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76844.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-76844
Aliases
Downstream
AZL (1)
CGA (38)
CLSA (16)
ECHO (1)
MINI (6)
ROOT (1)
Published
2026-08-24T13:12:01Z
Modified
2026-10-14T07:10:13Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write
Details

zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76844.json"
}
References

Affected packages

Git / github.com/madler/zlib

Affected ranges

Type
GIT
Repo
https://github.com/madler/zlib
Events
Introduced
cacf7f1d4e3d44d871b605da3b647f07d718623f
Fixed
da607da739fa6047df13e66a2af6b8bec7c2a498
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
570720b0c24f9686c33f35a1b3165c1f568b96be
Fixed
df84af25dc1942490e1d1c899a07619152a46148
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.2.11"
        },
        {
            "fixed":  "1.3.2"
        },
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.3.1.2"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.2.11
v1.2.12
v1.2.13
v1.3
v1.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76844.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "94557474100807838653100501376880416687",
                "241993643407371955548973125798057698501",
                "179268733966957879736352493294299716250"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-76844-4d0e32f4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/madler/zlib/commit/570720b0c24f9686c33f35a1b3165c1f568b96be",
        "target":  {
            "file":  "deflate.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "298256010342233320403953179587420994486",
                "304753402722452017931396826415910899197",
                "84890611830550294116388123009164973797",
                "305294332451176924101710687848488803236",
                "34733096881164427775731547611031468195",
                "10421832822737839981063407933824629570",
                "73549419877660507543226264114412419782",
                "171979836933231787876038708310648451405"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-76844-72376cc3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/madler/zlib/commit/570720b0c24f9686c33f35a1b3165c1f568b96be",
        "target":  {
            "file":  "contrib/infback9/inftree9.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "281075721717734810581220934387571625225",
                "169437545400660320693512107130534053848",
                "19892860309634490294703178019729848088",
                "180763229905933804546063935939196182799",
                "124519007697485423212978743618328545779",
                "99776724811319399235429816708145432758",
                "91098846152240227901045382792730484372",
                "78880879027778696886178205518335749323"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-76844-c47f859a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/madler/zlib/commit/570720b0c24f9686c33f35a1b3165c1f568b96be",
        "target":  {
            "file":  "inftrees.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "321090108084038968139662894088929200997",
                "2390431503662171455844889591158512276",
                "135295985711956928995159240810902034005",
                "87796769545444147572130438046479323601",
                "235441658041769278382234619656069783544"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-76844-d61a29f0",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148",
        "target":  {
            "file":  "gzwrite.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "263750299263033607512351826485480615201",
            "length":  1343
        },
        "id":  "CVE-2026-76844-dc9ae361",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148",
        "target":  {
            "file":  "gzwrite.c",
            "function":  "gz_write"
        }
    }
]
vanir_signatures_modified 
"2026-10-14T07:10:13Z"