CVE-2018-25032
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
CVSS
7.5
High
EPSS
51.7%
p99
KEV
—
Exploit Today
30
0-100
Published: Mar 25, 2022 · Last modified: Oct 14, 2026 · CWE-787
51.7%EPSS · 30 days51.7%
2026-09-212026-10-19
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
- seclists.orghttp://seclists.org/fulldisclosure/2022/May/33
- seclists.orghttp://seclists.org/fulldisclosure/2022/May/35
- seclists.orghttp://seclists.org/fulldisclosure/2022/May/38
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2022/03/25/2
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2022/03/26/1
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf
- github.comhttps://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531
- github.comhttps://github.com/madler/zlib/compare/v1.2.11...v1.2.12
- github.comhttps://github.com/madler/zlib/issues/605
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2022/04/msg00000.html
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2022/05/msg00008.html
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2022/09/msg00023.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/
- security.gentoo.orghttps://security.gentoo.org/glsa/202210-42
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20220526-0009/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-92449——
———`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.
The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller, so the loader corrupts its own arena. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.
Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.4hCVE-2026-91189——
———The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count.
That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.4hCVE-2026-91186——
———The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time.
A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one after IDAT rewrites the image width, height, bit depth and pixel depth *after* the decoded-data buffer has already been allocated and filled from the original values. The pass that reverses the PNG row filters then derives its own extent from the new dimensions and walks the old allocation, moving image bytes past the end of it.
The buffer is allocated by GUIX rather than supplied by the caller, so the application has no way to size it defensively. The decoder is compiled in by default.4hCVE-2026-910417.8 HIG—
———Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FX_MEDIA driver callback, giving control of the instruction pointer.5hCVE-2026-1098315.4 MED—
——0UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service (DoS) condition.14hCVE-2026-869815.5 MED—
——0An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.4h