# zlib 1.4 fixes multiple memory-safety flaws — and changes Windows build compatibility

The November 4 zlib release addresses buffer overflows, unsafe decompression and archive extraction paths, while changing MSVC library names and raising its CMake minimum. Builders need to check bundled copies and rebuild assumptions.

zlib 1.4 fixes CVE-2026-85091 in nonblocking gzwrite, an inflateGetDictionary overwrite of up to 8 MB beyond a 32 KB buffer, and minizip path traversal. It also includes breaking build and API-behaviour changes.

- Status: Active
- Published: 2026-11-06T08:38:59+13:00
- Updated: 2026-11-06T08:38:59+13:00
- Categories: Cloud & Infrastructure, Deployment & DevOps
- Tags: compression, security, zlib
- Canonical HTML: https://beyondthe.news/dossiers/zlib-1-4-security-gzwrite-inflate-minizip-build-compatibility

## What changed

On November 4, 2026, upstream zlib released 1.4 after 1.3.2, documenting multiple security repairs in gzwrite, inflate, deflate and bundled minizip. The upstream notes also identify breaking changes in CMake requirements, MSVC library filenames, offset types and some gzip/deflate behaviours. The project still warns that contrib/iostream2 is unsafe with untrusted compressed data.

## Why it matters

zlib is embedded in software stacks, compression pipelines and archive utilities; fixing the system package alone may not update vendored or statically linked copies. Security patching therefore needs an inventory of linked versions and testing for build compatibility. Affected code paths vary: these are not all universally remotely exploitable vulnerabilities.

## Memory-safety and archive handling

Upstream lists CVE-2026-85091, a buffer overflow in non-blocking gzwrite; an inflateGetDictionary path that could overwrite up to 8 MB beyond a 32 KB caller buffer in 1.3.1 and 1.3.2; inflateSync and inflatePrime memory-access issues; and minizip fixes including directory traversal during extraction. Exposure depends on which interfaces are used and whether an attacker can control input.

## Upgrade compatibility is not automatic

The minimum CMake version rises from 3.12 to 3.15, MSVC library names change from z to libz, and applications built with zlib 1.3.2 headers on Windows may need recompilation because z_off_t reverts to long in some configurations. The documented deflateReset and raw-deflate return behaviour also changes.

## A known unsafe contribution remains

Upstream explicitly warns that contrib/iostream2 can trust an unbounded compressed-data length and overflow a destination buffer. It advises contrib/iostream3 instead. Version 1.4 does not eliminate this separate known issue.

## Evidence and limits

The official zlib 1.4 release page provides exact function-level fixes and compatibility notes; Phoronix independently reports the release. The evidence does not establish active exploitation, downstream distro backport status, or that all zlib consumers are exposed.

## Key details

- Release date: 4 November 2026.
- CVE-2026-85091 affects nonblocking gzwrite.
- inflateGetDictionary overwrite can extend up to 8 MB past caller's 32 KB buffer in affected 1.3.1/1.3.2 paths.
- minizip fixes address directory escape during extraction.
- CMake minimum now 3.15; MSVC libraries renamed.
- contrib/iostream2 remains unsafe for untrusted data.

## Builder takeaways

- Inventory dynamically linked, statically linked and vendored zlib copies.
- Plan an upgrade to 1.4 or verify distribution backports and test affected interfaces.
- Run Windows and CMake build compatibility tests before deployment.
- Audit minizip extraction of untrusted archives and avoid contrib/iostream2.
- Do not assume all listed flaws have the same severity or exploitation preconditions.

## What to watch

- Downstream package advisories and fixed-version mappings.
- Compatibility regressions after zlib 1.4 upgrades.
- Independent exploitability analysis and further fixes to contrib components.

## Uncertainties

- No independently verified exploitation in the wild.
- Distribution backports and affected vendor bundles not exhaustively mapped.
- Specific exploit preconditions differ across fixed routines.

## Sources

- [zlib 1.4 release notes](https://zlib.net/) — zlib project · primary · 2026-11-04T00:00:00+13:00. Primary version, CVE, memory-safety, build-compatibility and remaining-issue details.
- [Zlib 1.4 released with security fixes](https://www.phoronix.com/news/Zlib-1.4-Released) — Phoronix · secondary · 2026-11-05T00:00:00+13:00. Independent release coverage, not an independent exploit reproduction.