zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function. The flaw is triggered during non-blocking gzwrite() operations when stale external buffer pointers are present. Attackers can exploit this by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary. This can potentially lead to memory corruption, crashes, or arbitrary code execution. The vulnerability is tracked as CVE-2026-85091 and has been assigned a high criticality rating. Affected users of zlib in the specified version range are advised to apply patches or mitigations promptly. References include the NVD advisory, the zlib GitHub repository, the specific vulnerable source file, and a VulnCheck advisory.