zlib vulnerability affects Ubuntu 24.04, 26.04 LTS, and 26.10
Key Takeaway
A heap buffer overflow vulnerability in zlib could allow for denial of service or arbitrary code execution.
Summary
Ubuntu has released security updates for the zlib lossless data-compression library to address a vulnerability discovered by Ali Firas. The issue stems from incorrect handling of certain non-blocking write operations, which could lead to a heap buffer overflow. Affected Ubuntu releases include 24.04 LTS, 26.04 LTS, and 26.10.
Technical details of the zlib flaw
- The vulnerability is identified as CVE-2026-85091.
- It involves incorrect handling of non-blocking write operations.
- Exploitation can trigger a heap buffer overflow.
- Potential impacts include denial of service (DoS) or arbitrary code execution.
Why it matters
As a fundamental data-compression library, zlib is used by a vast number of applications and system components, making this a critical update for system stability and security.
What to do
- Perform a standard system update to address the vulnerability.
- For Ubuntu 26.10, update zlib packages to version 1:1.3.dfsg+really1.3.2-3ubuntu1.1.
- For Ubuntu 26.04 LTS, update zlib packages to version 1:1.3.dfsg+really1.3.1-1ubuntu3.2.
- For Ubuntu 24.04 LTS, update zlib packages to version 1:1.3.dfsg-3.1ubuntu2.3.
Original reference: ubuntu.com →