CVE-2026-76844 zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write
Heap buffer overflow in zlib allows attackers to execute arbitrary code or cause denial of service via stale pointers after write failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-76844?
CVE-2026-76844 is a high-severity memory corruption vulnerability in zlib, published on 24 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.
Weakness: CWE-787
Which versions are affected by CVE-2026-76844?
4 open source packages ship an affected version, including webpack-dev-middleware.
| Package | Affected | Fixed in |
|---|---|---|
webpack-dev-middleware npm | All versions | 7.4.6 |
webpack-dev-middleware npm | All versions | 7.4.6 |
webpack-dev-middleware npm | From 8.0.0 | 8.3.0 |
webpack-dev-middleware npm | From 8.0.0 | 8.3.0 |
How do I fix CVE-2026-76844?
Upgrade webpack-dev-middleware to a fixed version for your release line: 7.4.6 or 8.3.0.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-76844 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-76844 exists.
Sources
Also known as AZL-105345, CLSA-2026-1787602147, CLSA-2026-1790604916, CLSA-2026-1790755864, CLSA-2026-1790756051, CLSA-2026-1790876768 and 27 more.