CVE-2026-85091

Publication date 3 September 2026

Last updated 22 October 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.4 · High

Score breakdown

Description

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

Read the notes from the security team

Status

Package Ubuntu Release Status
zlib 26.10 stonking
Fixed in 1:1.3.dfsg+really1.3.2-3ubuntu1.1
26.04 LTS resolute
Fixed in 1:1.3.dfsg+really1.3.1-1ubuntu3.2
24.04 LTS noble
Fixed in 1:1.3.dfsg-3.1ubuntu2.3
22.04 LTS jammy
Needs evaluation
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation
14.04 LTS trusty
Needs evaluation
rsync 26.10 stonking
Not affected
26.04 LTS resolute
Not affected
24.04 LTS noble
Not affected
22.04 LTS jammy
Not affected
20.04 LTS focal
Vulnerable
18.04 LTS bionic
Vulnerable
16.04 LTS xenial
Vulnerable
14.04 LTS trusty
Not affected
klibc 26.10 stonking
Vulnerable
26.04 LTS resolute
Vulnerable
24.04 LTS noble
Vulnerable
22.04 LTS jammy
Vulnerable
20.04 LTS focal
Vulnerable
18.04 LTS bionic
Vulnerable
16.04 LTS xenial
Vulnerable
14.04 LTS trusty
Vulnerable
zsync 26.10 stonking
Vulnerable
26.04 LTS resolute
Vulnerable
24.04 LTS noble
Vulnerable
22.04 LTS jammy
Vulnerable
20.04 LTS focal
Vulnerable
18.04 LTS bionic
Vulnerable
16.04 LTS xenial
Vulnerable

Notes

mdeslaur

since 3.2.0-1, rsync builds with the system zlib It is unclear by this CVE, and the advisory that goes along with it, what versions of zlib are affected by this issue. Per the advisory, versions below 1.3.1 are not affected, but the reproducer crashes 1.3.0 in the same way it does 1.3.1. The more severe vulnerability was introduced in 1.3.1.2 by the following commit: https://github.com/madler/zlib/commit/81cc0be See request for more information here: https://github.com/madler/zlib/issues/1310#issuecomment-5979623265 Need to test the new patch below to make sure it actually fixes the issue.

mrmajumder

The current upstream patch has been applied to versions 1.3.1 and above for zlib. However, based on pending upstream decision, the lower versions may also be affected (2026-10-22)

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
zlib

Severity score breakdown

CVSS version:

Base score 8.3 · High

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Base score 7.4 · High

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities