What changed
On November 4, 2026, upstream zlib released 1.4 after 1.3.2, documenting multiple security repairs in gzwrite, inflate, deflate and bundled minizip. The upstream notes also identify breaking changes in CMake requirements, MSVC library filenames, offset types and some gzip/deflate behaviours. The project still warns that contrib/iostream2 is unsafe with untrusted compressed data.
Why it matters
zlib is embedded in software stacks, compression pipelines and archive utilities; fixing the system package alone may not update vendored or statically linked copies. Security patching therefore needs an inventory of linked versions and testing for build compatibility. Affected code paths vary: these are not all universally remotely exploitable vulnerabilities.
Memory-safety and archive handling
Upstream lists CVE-2026-85091, a buffer overflow in non-blocking gzwrite; an inflateGetDictionary path that could overwrite up to 8 MB beyond a 32 KB caller buffer in 1.3.1 and 1.3.2; inflateSync and inflatePrime memory-access issues; and minizip fixes including directory traversal during extraction. Exposure depends on which interfaces are used and whether an attacker can control input.
Upgrade compatibility is not automatic
The minimum CMake version rises from 3.12 to 3.15, MSVC library names change from z to libz, and applications built with zlib 1.3.2 headers on Windows may need recompilation because z_off_t reverts to long in some configurations. The documented deflateReset and raw-deflate return behaviour also changes.
A known unsafe contribution remains
Upstream explicitly warns that contrib/iostream2 can trust an unbounded compressed-data length and overflow a destination buffer. It advises contrib/iostream3 instead. Version 1.4 does not eliminate this separate known issue.
Evidence and limits
The official zlib 1.4 release page provides exact function-level fixes and compatibility notes; Phoronix independently reports the release. The evidence does not establish active exploitation, downstream distro backport status, or that all zlib consumers are exposed.