---
title: zlib 1.4 fixes a stack of memory bugs, including a non-blocking gzwrite() buffer overflow (CVE-2026-85091) and an inflateGetDictionary() overrun of up to 8 MB | ctxsec
url: https://ctxsec.com/items/zlib-1-4-security-fixes-gzwrite-overflow-cve-2026-85091-minizip
description: "zlib 1.4 (first security-focused cut since 1.3.2) patches several memory-safety issues found by Trail of Bits, Theorem, independent researchers and at least one Claude Opus 5.5 finding: a buffer overflow in non-blocking gzwrite() (CVE-2026-85091), inflateGetDictionary() writing up to 8 MB past a caller's 32K buffer after an invalid window size plus inflateReset/inflateSync (1.3.1 and 1.3.2), inflateSync() allocating a one-byte window that could later be overrun, inflatePrime/deflatePrime overruns, inflateBack() copying uninitialized memory, mid-stream deflateResetKeep() reads outside the window, and multiple minizip issues (double free, Zip64/extra-field parsing, path traversal on extract). Release notes also list CMake and API behavior changes."
status: "official (zlib 1.4 release notes / GitHub release, published Nov 5 UTC; notes dated Nov 4); no exploitation reported"
published: 2026-11-05
---

> zlib 1.4 (first security-focused cut since 1.3.2) patches several memory-safety issues found by Trail of Bits, Theorem, independent researchers and at least one Claude Opus 5.5 finding: a buffer overflow in non-blocking gzwrite() (CVE-2026-85091), inflateGetDictionary() writing up to 8 MB past a caller's 32K buffer after an invalid window size plus inflateReset/inflateSync (1.3.1 and 1.3.2), inflateSync() allocating a one-byte window that could later be overrun, inflatePrime/deflatePrime overruns, inflateBack() copying uninitialized memory, mid-stream deflateResetKeep() reads outside the window, and multiple minizip issues (double free, Zip64/extra-field parsing, path traversal on extract). Release notes also list CMake and API behavior changes.

[← Cybersecurity News](/news) · [markdown](/items/zlib-1-4-security-fixes-gzwrite-overflow-cve-2026-85091-minizip.md)

official (zlib 1.4 release notes / GitHub release, published Nov 5 UTC; notes dated Nov 4); no exploitation reported

2026-11-05

### zlib 1.4 fixes a stack of memory bugs, including a non-blocking gzwrite() buffer overflow (CVE-2026-85091) and an inflateGetDictionary() overrun of up to 8 MB

- **Upgrade:** move applications and images that ship or statically link zlib/minizip to 1.4. Distro packages will lag; check your base images and language runtimes that vendor zlib.
- **Highest-impact callers:** anything that decompresses untrusted gzip/deflate (HTTP clients, package managers, backup tools, document parsers) and anything that uses minizip on untrusted archives.
- **Breaking changes to watch:** MSVC library names (`libz`), `deflateReset()` now clears a gzip header set by `deflateSetHeader()`, and raw deflate that finishes exactly at the output buffer end returns `Z_STREAM_END` instead of `Z_OK`.

Sources: [zlib 1.4 GitHub release notes](https://github.com/madler/zlib/releases/tag/v1.4) · [oss-security: zlib 1.4 released with security fixes (Alan Coopersmith, Nov 5)](https://seclists.org/oss-sec/2026/q4/529)