Vulnerability Description
zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zlib | Zlib | <= 1.3.1.2 |
Related Weaknesses (CWE)
References
- https://github.com/madler/zlibProduct
- https://seclists.org/fulldisclosure/2026/Jan/3Mailing ListThird Party Advisory
- https://www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfnaThird Party Advisory
- https://zlib.net/Product
- https://github.com/madler/zlib/issues/1142Issue Tracking
FAQ
What is CVE-2026-22184?
CVE-2026-22184 is a vulnerability with a CVSS score of 7.8 (HIGH). zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and do...
How severe is CVE-2026-22184?
CVE-2026-22184 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-22184?
Check the references section above for vendor advisories and patch information. Affected products include: Zlib Zlib.