CVE-2026-22184

Name
CVE-2026-22184
Description
zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
product https://github.com/madler/zlib
technical-description https://seclists.org/fulldisclosure/2026/Jan/3
third-party-advisory https://www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfname
product https://zlib.net/
af854a3a-2127-422b-91ae-364da2661108 https://github.com/madler/zlib/issues/1142

Match rules

CPE URI Source package Min version Max version
zlib >= 0 <= 1.3.1.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
zlib edge-main 1.3.1-r2 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib edge-main 1.3.1-r1 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib edge-main 1.3.1-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib edge-main 1.3-r2 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib edge-main 1.3-r1 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib edge-main 1.3-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib edge-main 1.2.12-r3 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib edge-main 1.2.12-r2 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib edge-main 1.2.11-r4 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib 3.23-main 1.3.1-r2 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib 3.22-main 1.3.1-r2 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib 3.22-main 1.2.12-r2 None fixed
zlib 3.22-main 1.2.11-r4 None fixed
zlib 3.21-main 1.3.1-r2 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib 3.21-main 1.2.12-r2 None fixed
zlib 3.21-main 1.2.11-r4 None fixed
zlib 3.20-main 1.3.1-r1 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib 3.20-main 1.2.12-r2 None fixed
zlib 3.20-main 1.2.11-r4 None fixed
zlib 3.19-main 1.3.1-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib 3.19-main 1.3-r2 Natanael Copa <ncopa@alpinelinux.org> fixed
zlib 3.19-main 1.2.12-r2 None fixed
zlib 3.19-main 1.2.11-r4 None fixed