CVE-2026-22184: zlib software zlib Out-of-bounds Write
Vulnerability summary
CVE-2026-22184 is a high (CVSS 8.6) Out-of-bounds Write vulnerability in zlib software zlib. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 07-01-2026PublishedVulnerability first disclosed.
- 01-09-2026Last modifiedVulnerability information updated.
Description
zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.
CVSS metrics
10 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
-0.01 pp
From 0.42% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Affected systems
Chainguard2 products
- minizipAll versions (No fix recorded)
- zlibAll versions (No fix recorded)
Wolfi2 products
- minizipAll versions (No fix recorded)
- zlibAll versions (No fix recorded)
Alpine1 product
- zlib< 1.3.2-r0
Debian1 product
- zlib< 1:1.2.6.dfsg-1
Mageia1 product
- zlib< 1.2.13-1.3.mga9
Ubuntu1 product
- zsyncAll versions (No fix recorded)
Zlib1 product
- zlib≤ 1.3.1.2
Zlib software1 product
- zlib≤ 1.3.1.2
8 vendors · 10 products
References
18 links- seclists.org/fulldisclosure/2026/Jan/3Technical DescriptionExploitREPORTEVIDENCEMailing ListThird Party Advisory
- www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfnameThird Party AdvisoryREPORTAdvisory
