Description
zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.
Metrics
CVSS 3.1 7.8/10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| zlib software | zlib | <= 1.3.1.2 |
| Red Hat | Logging Subsystem for Red Hat OpenShift | — |
| Red Hat | Logging Subsystem for Red Hat OpenShift | — |
| Red Hat | Logging Subsystem for Red Hat OpenShift | — |
| Red Hat | Logging Subsystem for Red Hat OpenShift | — |
| Red Hat | Logging Subsystem for Red Hat OpenShift | — |
| Red Hat | Logging Subsystem for Red Hat OpenShift | — |
| Red Hat | Logging Subsystem for Red Hat OpenShift | — |
| Red Hat | Red Hat build of OpenJDK 11 ELS | — |
| Red Hat | Red Hat build of OpenJDK 11 ELS | — |
| Red Hat | Red Hat build of OpenJDK 11 ELS | — |
| Red Hat | Red Hat build of OpenJDK 17 | — |
| Red Hat | Red Hat build of OpenJDK 17 | — |
| Red Hat | Red Hat build of OpenJDK 1.8 | — |
| Red Hat | Red Hat build of OpenJDK 21 | — |
| Red Hat | Red Hat build of OpenJDK 21 | — |
| Red Hat | Red Hat build of OpenJDK 25 | — |
| Red Hat | Red Hat build of OpenJDK 25 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 6 | — |
| Red Hat | Red Hat Enterprise Linux 7 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat JBoss Core Services | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — |
References
- https://github.com/madler/zlibProduct
- https://seclists.org/fulldisclosure/2026/Jan/3Mailing List, Third Party Advisory
- https://www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfnameThird Party Advisory
- https://zlib.net/Product
- https://github.com/madler/zlib/issues/1142Issue Tracking
- https://access.redhat.com/security/cve/CVE-2026-22184
- https://bugzilla.redhat.com/show_bug.cgi?id=2427688
- https://cert-portal.siemens.com/productcert/html/ssa-470355.html
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22184.json
Timeline
- Published
- Jan 7, 2026
- Last modified
- Sep 1, 2026
- NVD status
- Modified