CVE-2026-22184

A flaw was found in zlib. A global buffer overflow vulnerability exists in the untgz utility, specifically within the TGZfname() function. This flaw allows an attacker to provide an archive name longer than 1024 bytes, leading to an out-of-bounds write. This can result in memory corruption, denial of service, and potentially arbitrary code execution on the affected system.

This vulnerability is rated Important rather than Critical because, although it allows a classic global buffer overflow that can compromise the availability of the affected process and potentially impact integrity, it does not meet the criteria for easy, remote, unauthenticated system compromise. The flaw is confined to the untgz command-line utility and is triggered only through attacker-controlled command-line arguments, not through automatic processing of network data or background services. Exploitation therefore generally requires local access or a cooperating application or script that passes untrusted input to untgz, which places it outside the class of wormable or directly remote exploits. While the vulnerability can reliably cause a denial of service and may lead to code execution under specific build and runtime conditions, such outcomes are highly dependent on compiler hardening, memory layout, and execution context, making exploitation less straightforward than required for a Critical rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, avoid using the untgz utility with untrusted archive names or from untrusted sources. System administrators should ensure that any automated processes or user interactions involving untgz validate the length of archive names to prevent triggering the buffer overflow. If the untgz utility is not essential for system operation, consider restricting its execution permissions or removing the package that provides it, if applicable.