Security readout for executives and security teams
Plain-English summary
A memory-safety flaw affects zlib's optional untgz demonstration program through version 1.3.1.2, not the core zlib library. An excessively long archive name supplied when launching untgz can overwrite memory, potentially causing serious disruption and limited data impact. Organizations using zlib only as a library are not exposed.
Executive priority
Prioritize rapid scoping rather than treating this as a fleet-wide zlib emergency. Escalate confirmed untgz deployments handling untrusted names to high priority. Systems using only the core library can be documented as outside the described vulnerable surface, subject to vendor confirmation.
Technical view
TGZfname() writes an excessively long command-line archive name beyond a fixed-size global buffer, classified as CWE-120 and CWE-787. The bundle assigns CVSS 3.1 8.6 but does not establish code execution. The vulnerable surface is contrib/untgz only. The supplied network attack vector conflicts with the documented command-line precondition.
Likely exposure
Exposure requires the standalone contrib/untgz utility from zlib 1.3.1.2 or earlier to be present and executed with attacker-influenced archive names. Merely linking or installing the core zlib compression library does not create exposure. Internet reachability is not established by the supplied evidence.
Exploitation context
The bundle marks KEV false and provides no evidence of exploitation in the wild. It links a public Full Disclosure item tagged as an exploit, indicating public exploitation material may exist. That increases opportunistic-abuse risk but does not establish active attacks or reliable remote exploitation.
Researcher notes
The stated CVSS vector describes network access without user interaction, while the narrative requires command-line execution of untgz with a long archive name. Treat this inconsistency as material. The bundle supports an out-of-bounds write but does not prove code execution, remote reachability, active exploitation, or a specific fixed version.
Mitigation direction
- Stop using contrib/untgz for untrusted or externally supplied archive names.
- Remove or restrict the demonstration utility where it is not operationally required.
- Apply strict archive-name length validation before any necessary untgz invocation.
- Check upstream and distributor guidance for a confirmed fixed release or backport.
Validation and detection
- Inventory systems for untgz; do not infer exposure from core zlib presence alone.
- Confirm whether installed untgz builds derive from zlib 1.3.1.2 or earlier.
- Determine whether users, automation, or services pass untrusted archive names to untgz.
- Review crashes and memory-corruption indicators involving untgz.
- Verify vendor package disposition before closing remediation findings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22184 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H3.94.7redhat-SADPCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
4.6MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-01-07T21:02:32.602Z: Reported to Red Hat.
- 2026-01-07T20:25:19.892Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://seclists.org/fulldisclosure/2026/Jan/3CVE reference, VulnCheck · technical-description, exploit
- https://zlib.net/CVE reference, VulnCheck · product
- https://github.com/madler/zlibCVE reference, VulnCheck · product
- https://www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfnameCVE reference, VulnCheck · third-party-advisory
- https://github.com/madler/zlib/issues/1142CVE reference, CVE
- https://access.redhat.com/security/cve/CVE-2026-22184CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2427688CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22184.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://cert-portal.siemens.com/productcert/html/ssa-470355.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.