{"id":"EUVD-2026-64850","revision":"6cc63343d9e54619a95151dfa8911afa","records":[{"revision":"6cc63343d9e54619a95151dfa8911afa","observedAt":"2026-10-28T09:42:10.788+00:00","statement":{"source":"euvd","id":"EUVD-2026-64850","aliases":["CVE-2026-76844","GHSA-p3f5-w63m-mxph","GHSA-g84c-rxfj-3j2c"],"title":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from …","description":"zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.3,"severity":null}],"references":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://github.com/madler/zlib","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64850","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 24, 2026, 1:12:01 PM","dateUpdated":"Oct 1, 2026, 11:03:59 AM"},"relatedAdvisories":[{"id":"msrc_CVE-2026-76844","title":"zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write","vulnerabilityIds":["CVE-2026-76844"]},{"id":"RHSA-2026:61783","title":"Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage","vulnerabilityIds":["CVE-2024-29180","CVE-2026-1965","CVE-2026-3783","CVE-2026-5704","CVE-2026-6322","CVE-2026-6653","CVE-2026-8286","CVE-2026-9547","CVE-2026-11822","CVE-2026-11824","CVE-2026-11979","CVE-2026-14164","CVE-2026-15588","CVE-2026-18477","CVE-2026-18508","CVE-2026-41991","CVE-2026-41992","CVE-2026-45409","CVE-2026-45623","CVE-2026-54284","CVE-2026-54371","CVE-2026-56434","CVE-2026-58010","CVE-2026-58011","CVE-2026-58012","CVE-2026-58013","CVE-2026-58014","CVE-2026-58015","CVE-2026-58055","CVE-2026-59868","CVE-2026-59869","CVE-2026-59893","CVE-2026-60005","CVE-2026-67213","CVE-2026-67214","CVE-2026-71491","CVE-2026-73643","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76844"]},{"id":"RHSA-2026:68681","title":"Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.17 update","vulnerabilityIds":["CVE-2026-14257","CVE-2026-16221","CVE-2026-27145","CVE-2026-33186","CVE-2026-33818","CVE-2026-42504","CVE-2026-56852","CVE-2026-56853","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69152","CVE-2026-69192","CVE-2026-73088","CVE-2026-73089","CVE-2026-73566","CVE-2026-73643","CVE-2026-73646","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76844","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"RHSA-2026:69296","title":"Red Hat Security Advisory: Red Hat Data Grid 8.6.3 security update","vulnerabilityIds":["CVE-2026-44891","CVE-2026-49978","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-56745","CVE-2026-56746","CVE-2026-56817","CVE-2026-56819","CVE-2026-56820","CVE-2026-59296","CVE-2026-59899","CVE-2026-59901","CVE-2026-62243","CVE-2026-68494","CVE-2026-73508","CVE-2026-76844"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-64850","identifiers":["EUVD-2026-64850","CVE-2026-76844","GHSA-p3f5-w63m-mxph","GHSA-g84c-rxfj-3j2c"]},"retained":false,"historicalAffected":[]}],"coverage":[]}