CVE-2026-27820CWE-120CWE-131

zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

Low · published April 16, 2026

CVSS v4.0
1.7
EPSS
1%
Percentile
54.5
In the wild
Unconfirmed
What it is

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.

The record
Technical detail
CVSS v4.0
1.7 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
EPSS
0.00752 · 54.5th percentile
Weaknesses
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'); CWE-131 · Incorrect Calculation of Buffer Size
Published
2026-04-16T17:27Z
EPSS history
Timeline
  • 16 APR 17:27Z
    zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption
    cvelistv5