Use of Uninitialized Resource Affecting zlib package, versions [,1.3.2)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CONAN-ZLIB-20840310
- published12 Oct 2026
- disclosed18 Feb 2026
- creditUnknown
Introduced: 18 Feb 2026
CVE NOT AVAILABLE CWE-908 (opens in a new tab)How to fix?
Upgrade zlib to version 1.3.2 or higher.
Overview
Affected versions of this package are vulnerable to Use of Uninitialized Resource in the inflateCopy function in inflate.c, which allocates a destination sliding window and then zmemcpys the full wsize from the source window without regard to whave, the counter tracking how much of that window holds valid data. An attacker able to read the destination stream state, through a process memory dump, a serialization or logging interface, or a separate arbitrary read, can recover residual heap contents from earlier allocations, because zcalloc is backed by malloc rather than calloc and leaves the region between whave and wsize uninitialized. This requires the source stream to have not yet filled its window and an application that both calls inflateCopy and exposes the copied state.
Note: This cannot be triggered by compressed input alone. inflateCopy has no callers inside the library, and the propagated bytes stay in zlib-internal buffers that no API returns.