Use of Uninitialized Resource Affecting madler/zlib package, versions [,1.3.2)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UNMANAGED-MADLERZLIB-20840349
- published12 Oct 2026
- disclosed18 Feb 2026
- creditUnknown
Introduced: 18 Feb 2026
CVE NOT AVAILABLE CWE-908 (opens in a new tab)How to fix?
Upgrade madler/zlib to version 1.3.2 or higher.
Overview
Affected versions of this package are vulnerable to Use of Uninitialized Resource in the deflateCopy function in deflate.c, which zmemcpys the full allocated capacity of the source window, prev, and pending_buf rather than the initialized extents tracked by high_water, the active hash chains, and pending. An attacker able to read the destination stream state, through a process memory dump, a serialization or logging interface, or a separate arbitrary read, can recover residual heap contents from earlier allocations, which the copy resurrects into a live object. This requires large untouched regions in the source buffers, which the lazy window initialization and the documented garbage entries in prev make ordinary, and an application that both calls deflateCopy and exposes the copied state.
Note: This cannot be triggered by compressed input alone. deflateCopy has no callers inside the library, and the propagated bytes stay in zlib-internal buffers that no API returns.