zlib 1.4 Fixes Memory Corruption and ZIP Extraction Flaws

zlib 1.4 has been released with more than a dozen security fixes spanning the widely used compression library, minizip and miniunz archive tools, and the contributed infback9 component. Fixes address buffer overflows, out-of-bounds reads and writes, and uninitialized memory copied to output. Notable flaws include CVE-2026-85091, a buffer overflow during non-blocking compressed-file writes, and a dictionary-retrieval flaw affecting versions 1.3.1 and 1.3.2 that could write up to 8 MB beyond a caller’s 32 KB buffer. Archive-handling fixes address double-free and NULL-pointer errors, malformed ZIP metadata, and extraction vulnerabilities that could create directories outside the extraction destination or write files anywhere on Windows.

Exposure depends on which vulnerable operations an application reaches and under what conditions; the release does not establish universal remote code execution or an active attack campaign. The oss-sec announcement also disputes the critical rating of CVE-2026-4738 in infback9, stating that out-of-bounds pointers return within bounds before use and no compiler mishandling is known. Defenders should inventory the actual zlib copies used by applications and containers, update distribution packages and bundled dependencies, rebuild affected applications or images where necessary, and check restart requirements. Ubuntu’s earlier fixes for CVE-2026-85091 on Ubuntu 24.04 LTS do not cover every issue addressed by zlib 1.4.