CVE-2023-45853Critical· 9.8▾ MidnightMiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pymini…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.6 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.9%
2.9% → 3.2%
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
zlib < 1.3.1pyminizip <= 0.2.6Upgrade past the affected range:
zlib 1.3.1Affected packages:
pyminizip <= 0.2.6Source: https://osv.dev/vulnerability/GHSA-mq29-j5xf-cjwr
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-37434Critical· 9.8zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field
CVE-2026-42308Medium· 6.2Pillow: Pillow: Denial of Service via integer overflow in font processing (CVE-2026-42308)
CVE-2016-9842High· 8.8The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
CVE-2016-9841Critical· 9.8inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVE-2026-27622High· 8.4OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write
CVE-2026-34588High· 8.6OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write