CVE-2026-22184 (CVSS 9.3): Critical zlib Flaw Opens Door to Global Buffer Overflow

CVE-2026-22184 (CVSS 9.3) is a critical flaw in zlib that opens the door to a global buffer overflow, risking DoS or remote code execution on systems using the library’s untgz utility. The vulnerability stems from a memory management error in TGZfname(), which handles archive names passed on the command line. According to the disclosure, TGZfname() copies an attacker-supplied archive name from argv[] into a fixed-size 1024-byte global buffer using an unbounded strcpy() call.

If an archive name exceeds 1024 bytes, data can spill beyond the buffer, enabling memory corruption. The flaw is described as trivially reachable via command-line input, located at the program’s front door before any parsing or validation. It affects zlib versions up to and including 1.3.1.2, and administrators are urged to seek patched releases to mitigate this critical risk. This report was published on 12 January 2026.