Hi Mark, On Sun, Sep 06, 2026 at 09:02:48PM +0200, Salvatore Bonaccorso wrote: > Source: zlib > Version: 1:1.3.dfsg+really1.3.2-1 > Severity: grave > Tags: security upstream > Justification: user security hole > X-Debbugs-Cc: [email protected], Debian Security Team > <[email protected]> > > Hi, > > The following vulnerability was published for zlib. > > CVE-2026-85091[0]: > | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow > | vulnerability in the gz_vacate() function when processing non- > | blocking gzwrite() operations with stale external buffer pointers. > | Attackers can trigger the overflow by calling gzprintf() or > | gzvprintf() after a write stall, causing an unchecked memmove() to > | write beyond the internal input buffer boundary. > > > If you fix the vulnerability please also make sure to include the > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
Attached is a proposed update for zlib in unstable with one related patch cherry-picked and the upstream commited change for CVE-2026-85091. I tested the update as well against the published reporducers, and the update would be tested as well on https://debusine.debian.net/debian/developers/work-request/1293184/ Regards, Salvatore
