---
id: CVE-2026-22184
title: >-
  zlib versions up to and including 1.3.1.2 include a global buffer overflow in
  the untgz utility located under contrib/untgz
summary: >-
  zlib versions up to and including 1.3.1.2 include a global buffer overflow in
  the untgz utility located under contrib/untgz. The vulnerability is limited to
  the standalone demonstration utility and does not affect the core zlib
  compressi…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
  - CWE-787
  - CWE-120
vendor: zlib
product: zlib
affected:
  - zlib <= 1.3.1.2
published: '2026-01-07'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-22184'
references:
  - url: 'https://github.com/madler/zlib'
    label: disclosure@vulncheck.com
  - url: 'https://seclists.org/fulldisclosure/2026/Jan/3'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfname
    label: disclosure@vulncheck.com
  - url: 'https://zlib.net/'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/madler/zlib/issues/1142'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/security/cve/CVE-2026-22184'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2427688'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22184.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00419
epssPercentile: 0.33586
ingestedAt: '2026-06-30T13:26:50.199Z'
---

## Overview

zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.

## Affected

- `zlib <= 1.3.1.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.