zlib 1.4 fixes a dozen memory bugs and changes its build

zlib 1.4 fixes a dozen memory bugs and changes its build

4 November 2026: zlib, the compression library inside operating systems, browsers, language runtimes, databases and countless applications, has released version 1.4. The release notes list more than a dozen security fixes. They include a buffer overflow in non-blocking gzwrite(), CVE-2026-85091, and a flaw in inflateGetDictionary() that could write up to 8 MB past a caller's 32K buffer in 1.3.1 and 1.3.2. Several of the fixes come from an audit by Trail of Bits, whose finding numbers sit beside them. The same release carries breaking changes, so an upgrade is a rebuild, not a drop-in swap.

Not yet independently verified. zlib's page gives no severity scores and names CVEs for only two of the fixes; we have not checked which distributions have shipped 1.4 or backported the fixes. We will update this when it can be confirmed, and remove this note.

The memory bugs it fixes

Most of the fixes concern reading or writing memory a stream should not touch:

• inflateGetDictionary() could overwrite memory when given a zlib header with an invalid window size followed by inflateReset() or inflateSync();
• inflateSync() before the window size was known allocated a one-byte window that could later be overrun;
• inflatePrime() could lead inflate() to read before the start of the input, and repeated deflatePrime() calls could write past the pending buffer;
• inflateBack() missed distances that reached too far back and copied uninitialised memory to the output;
• gzseek() forward before any data was written could put uninitialised memory into the gzip output;
• deflateResetKeep() used mid-stream could read outside the window.

minizip, the ZIP code shipped with zlib, gets its own set. There is a double free in block_central_name(), a NULL dereference after a bad central directory, and stricter checks on extra-field sizes and Zip64 records. The fix that matters most for anyone unpacking untrusted archives is in miniunz, which could create directories outside the extraction directory and, on Windows, write files anywhere. Path names are now processed component by component. A separate fix in contrib/infback9 has CVE-2026-4738; the maintainers say its critical rating overstates it.

Breaking changes to plan for

Three changes will affect builds. CMake 3.15 is now the minimum. On MSVC the library names change, z becoming libz (libz.dll, libz.lib, and libzs.lib for the static build), with minizip following. And z_off_t is again a long rather than 1.3.2's long long, so the project says Windows applications built against 1.3.2 headers should be recompiled. Behaviour also tightens: deflateReset() now clears a gzip header set by deflateSetHeader(), raw deflate that ends exactly at the end of the output buffer returns Z_STREAM_END, and gzopen() with "x" fails where O_EXCL is not available instead of truncating an existing file.

Who has to act

Most organisations get zlib from their operating system or language runtime, so the practical step is to watch for those vendors' updates and apply them. Teams that vendor zlib or minizip into their own products, which is common in C and C++ code, embedded firmware and Windows applications, need to pull 1.4 themselves, check the renamed MSVC libraries in their build scripts, and recompile anything built against 1.3.2. Anything that extracts untrusted ZIP files with miniunz should be treated as a priority.

Sources

• zlib home page: Current release zlib 1.4, November 4, 2026 (key updates from 1.3.2), 4 November 2026
• zlib ChangeLog (read 5 November 2026), 5 November 2026