Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-25032

56
FAUCET Score

CVE-2018-25032 describes a memory corruption vulnerability in zlib versions prior to 1.2.12, occurring during deflation (compression) when processing input with numerous distant matches. This high-severity vulnerability (CVSS 7.5) is network-exploitable with low attack complexity and no user interaction, potentially leading to a denial of service. While affecting a wide range of products including Apple, Debian, and Microsoft, there is no evidence of active exploitation, public exploit code, or significant community discussion beyond a single Reddit mention.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.13.4CPE matchmatch criteria
cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:*
>= 3.7.0, < 3.7.14CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.8.0, < 3.8.14CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.9.0, < 3.9.13CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.10.0, < 3.10.5CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
50.84%
Probability of exploitation in next 30 days
EPSS Percentile
98.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.5084 is in the 98th percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (98)

debianpatch availablevia nvd_reference
View patch
denopatch availablevia llm_extracted
View patch
github_advisorypatch availablevia nvd_reference
View patch
keraspatch availablevia llm_extracted
View patch
microsoftpatch availablevia msrc
Product: 16977-16823Fixed in: -
microsoftpatch availablevia msrc
Product: 16982-16817Fixed in: -
microsoftpatch availablevia msrc
Product: 19801-17086Fixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: 19807-17084Fixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: 16968-16820Fixed in: 1.8.0.332-2
microsoftpatch availablevia msrc
Product: 16969-16820Fixed in: 8.6.13-1
microsoftpatch availablevia msrc
Product: 16978-16823Fixed in: 8.6.13-1
microsoftpatch availablevia msrc
Product: 16970-16820Fixed in: 2.7.18-13
microsoftpatch availablevia msrc
Product: 16971-16820Fixed in: 1.35.0-4
microsoftpatch availablevia msrc
Product: 16972-16820Fixed in: 24.2-2
microsoftpatch availablevia msrc
Product: 16973-16820Fixed in: 3.6-3
microsoftpatch availablevia msrc
Product: 16947-16820Fixed in: 1.66.0-4
microsoftpatch availablevia msrc
Product: 16974-16820Fixed in: 3.7.13-5
microsoftpatch availablevia msrc
Product: 16975-16820Fixed in: 10.3.36-1
microsoftpatch availablevia msrc
Product: 16976-16820Fixed in: 1.2.12-1
microsoftpatch availablevia msrc
Product: 16981-16823Fixed in: 1.2.12-1
microsoftpatch availablevia msrc
Product: 16979-16823Fixed in: 7.93-1
microsoftpatch availablevia msrc
Product: 16980-16823Fixed in: 1.76.0-3
microsoftpatch availablevia msrc
Product: 17879-17084Fixed in: 3.28.2-1
microsoftpatch availablevia msrc
Product: 20279-17084Fixed in: 1.62.0-2
microsoftpatch availablevia msrc
Product: 19666-17084Fixed in: 18.2.2-1
microsoftpatch availablevia msrc
Product: 19671-17084Fixed in: 1.75.0-13
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 1.66.0-4
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 24.2-2
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 10.3.36-1
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 7.90-4
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 1.66.0-4
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 24.2-2
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 10.3.36-1
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 7.90-4
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 1.76.0-3
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 7.93-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 5.15.9-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 1.76.0-3
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 7.93-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 5.15.9-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 3.28.2-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 1.62.0-2
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 3.28.2-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 1.62.0-2
microsoftpatch availablevia msrc
Product: azl3 ceph 18.2.2-8 on Azure Linux 3.0Fixed in: 18.2.2-1
microsoftpatch availablevia msrc
Product: 16825-17084Fixed in: 2.5.12-4
microsoftpatch availablevia msrc
Product: 16825-16817Fixed in: 2.5.12-4
microsoftpatch availablevia msrc
Product: 16982-17084Fixed in: -
microsoftpatch availablevia msrc
Product: azl3 rust 1.75.0-14 on Azure Linux 3.0Fixed in: 1.75.0-13
microsoftpatch availablevia msrc
Product: azl3 teckit 2.5.12-4 on Azure Linux 3.0Fixed in: 2.5.12-4
microsoftpatch availablevia msrc
Product: cbl2 cloud-hypervisor-cvm 38.0.72.2-1 on CBL Mariner 2.0Fixed in: -
microsoftpatch availablevia msrc
Product: azl3 cloud-hypervisor-cvm 38.0.72.2-1 on Azure Linux 3.0Fixed in: -
microsoftpatch availablevia msrc
Product: cbl2 cloud-hypervisor-cvm 38.0.72-1 on CBL Mariner 2.0Fixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: azl3 cloud-hypervisor-cvm 38.0.72-2 on Azure Linux 3.0Fixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: cm1 openjdk8 1.8.0.332-2 on CBL Mariner 1.0Fixed in: 1.8.0.332-2
microsoftpatch availablevia msrc
Product: cm1 tcl 8.6.13-1 on CBL Mariner 1.0Fixed in: 8.6.13-1
microsoftpatch availablevia msrc
Product: cbl2 tcl 8.6.13-1 on CBL Mariner 2.0Fixed in: 8.6.13-1
microsoftpatch availablevia msrc
Product: cm1 python2 2.7.18-13 on CBL Mariner 1.0Fixed in: 2.7.18-13
microsoftpatch availablevia msrc
Product: cm1 grpc 1.35.0-4 on CBL Mariner 1.0Fixed in: 1.35.0-4
microsoftpatch availablevia msrc
Product: cm1 erlang 24.2-2 on CBL Mariner 1.0Fixed in: 24.2-2
microsoftpatch availablevia msrc
Product: cm1 ccache 3.6-3 on CBL Mariner 1.0Fixed in: 3.6-3
microsoftpatch availablevia msrc
Product: cm1 boost 1.66.0-4 on CBL Mariner 1.0Fixed in: 1.66.0-4
microsoftpatch availablevia msrc
Product: cm1 python3 3.7.13-5 on CBL Mariner 1.0Fixed in: 3.7.13-5
microsoftpatch availablevia msrc
Product: cm1 mariadb 10.3.36-1 on CBL Mariner 1.0Fixed in: 10.3.36-1
microsoftpatch availablevia msrc
Product: cm1 zlib 1.2.12-1 on CBL Mariner 1.0Fixed in: 1.2.12-1
microsoftpatch availablevia msrc
Product: cbl2 zlib 1.2.12-1 on CBL Mariner 2.0Fixed in: 1.2.12-1
microsoftpatch availablevia msrc
Product: cbl2 nmap 7.93-1 on CBL Mariner 2.0Fixed in: 7.93-1
microsoftpatch availablevia msrc
Product: cbl2 boost 1.76.0-3 on CBL Mariner 2.0Fixed in: 1.76.0-3
microsoftpatch availablevia msrc
Product: azl3 cmake 3.21.4-10 on Azure Linux 3.0Fixed in: 3.28.2-1
microsoftpatch availablevia msrc
Product: azl3 grpc 1.42.0-7 on Azure Linux 3.0Fixed in: 1.62.0-2
oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: zlib-0:1.2.7-20.el7_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Advanced Update SupportFixed in: zlib-0:1.2.7-17.el7_4.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.6 Advanced Update Support(Disable again in 2026 - SPRHEL-7118)Fixed in: zlib-0:1.2.7-18.el7_6.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.7 Advanced Update SupportFixed in: zlib-0:1.2.7-18.el7_7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.7 Telco Extended Update SupportFixed in: zlib-0:1.2.7-18.el7_7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.7 Update Services for SAP SolutionsFixed in: zlib-0:1.2.7-18.el7_7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: mingw-zlib-0:1.2.8-10.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: zlib-0:1.2.11-18.el8_5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: rsync-0:3.1.3-14.el8_6.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: zlib-0:1.2.11-11.el8_1.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: rsync-0:3.1.3-6.el8_1.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: zlib-0:1.2.11-17.el8_2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: rsync-0:3.1.3-7.el8_2.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Extended Update SupportFixed in: rsync-0:3.1.3-12.el8_4.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Extended Update SupportFixed in: zlib-0:1.2.11-18.el8_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: zlib-0:1.2.11-31.el9_0.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: rsync-0:3.2.3-9.el9_0.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: mingw-zlib-0:1.2.12-2.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: redhat-virtualization-host-0:4.3.23-20220622.0.el7_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8Fixed in: redhat-virtualization-host-0:4.5.0-202205291010_8.6
View patch
redhatpatch availablevia redhat_api
Product: Text-Only JBCSFixed in: zlib
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6 Extended Lifecycle SupportFixed in: zlib-0:1.2.3-31.el6_10
View patch
rubygemspatch availablevia ghsa
Product: nokogiriFixed in: 1.13.4

Vendor Advisories (6)

microsoft2024-Sep/CVE-2018-25032

CVE-2018-25032

Sep 10, 2024
denollm-deno-b67a3af2ce0be075CRITICAL

HP ThinPro 8.0 SP 9 Security Updates

Jun 17, 2024
kerasllm-keras-7d8c31fee70361dcCRITICAL

HP ThinPro 8.0 SP 9 Security Updates

Jun 17, 2024
rubygemsGHSA-jc36-42cf-vqwjhigh

Nokogiri affected by zlib's Out-of-bounds Write vulnerability

Mar 26, 2022
microsoft2022-Mar/CVE-2018-25032Important

zlib before 1.2.12 allows memory corruption when deflating (i.e. when compressing) if the input has many distant matches.

Mar 8, 2022
redhatCVE-2018-25032Important

zlib: A flaw found in zlib when compressing (not decompressing) certain inputs

Apr 20, 2018

References

cert-portal.siemens.com / productcert/html/ssa-333517.html
cert-portal.siemens.com / productcert/html/ssa-398330.html
cert-portal.siemens.com / productcert/html/ssa-419740.html
cert-portal.siemens.com / productcert/html/ssa-470355.html
cert-portal.siemens.com / productcert/html/ssa-565386.html
cert-portal.siemens.com / productcert/html/ssa-942865.html
cert-portal.siemens.com / productcert/pdf/ssa-333517.pdf
Third Party Advisory
seclists.org / fulldisclosure/2022/May/33
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2022/May/35
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2022/May/38
Mailing ListThird Party Advisory
github.com / madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531
PatchThird Party Advisory
github.com / madler/zlib/compare/v1.2.11...v1.2.12
PatchThird Party Advisory
github.com / madler/zlib/issues/605
Issue TrackingPatchThird Party Advisory
lists.debian.org / debian-lts-announce/2022/04/msg00000.html
Mailing ListThird Party Advisory
lists.debian.org / debian-lts-announce/2022/05/msg00008.html
Mailing ListThird Party Advisory
lists.debian.org / debian-lts-announce/2022/09/msg00023.html
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF
Third Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB
Third Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4
Third Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F
Third Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y
Third Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU
Third Party Advisory
security.gentoo.org / glsa/202210-42
Third Party Advisory
security.netapp.com / advisory/ntap-20220526-0009
Third Party Advisory
security.netapp.com / advisory/ntap-20220729-0004
Third Party Advisory
support.apple.com / kb/HT213255
Third Party Advisory
support.apple.com / kb/HT213256
Third Party Advisory
support.apple.com / kb/HT213257
Third Party Advisory
debian.org / security/2022/dsa-5111
PatchThird Party Advisory
openwall.com / lists/oss-security/2022/03/24/1
Mailing ListThird Party Advisory
openwall.com / lists/oss-security/2022/03/28/1
ExploitMailing ListThird Party Advisory
openwall.com / lists/oss-security/2022/03/28/3
Mailing ListThird Party Advisory
oracle.com / security-alerts/cpujul2022.html
PatchThird Party Advisory
openwall.com / lists/oss-security/2022/03/25/2
Mailing ListThird Party Advisory
openwall.com / lists/oss-security/2022/03/26/1
ExploitMailing ListThird Party Advisory