Zlib
Vendor:
First CVE: Mar 15, 2002 · Active for 24 years
15
Total CVEs
More Total CVEs than 92% of tracked products
1.7
Avg CVEs / Year
Higher CVE frequency than 59% of tracked products
7.8
Avg CVSS
Higher Avg CVSS than 63% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Zlib over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 15, 2002
24 years ago
Most Recent CVE
Feb 18, 2026
156 days ago
CVE Severity & Scoring
Zlib15 CVEs
13%
47%
33%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local1 (6.7%)
Network10 (66.7%)
Unknown4 (26.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low11 (73.3%)
High0 (0.0%)
Unknown4 (26.7%)
User Interaction
None9 (60.0%)
Unknown4 (26.7%)
Required2 (13.3%)
Privileges Required
Low1 (6.7%)
High0 (0.0%)
None10 (66.7%)
Unknown4 (26.7%)
Top CVEs
Signals from CVEs in this product scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-25032HIGH zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. | Mar 25, 2022 | 7.5 | 56 | NO | NO |
CVE-2003-0107HIGH Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, allows attackers to cause a denia | Mar 7, 2003 | 7.5 | 48 | NO | YES |
CVE-2022-37434CRITICAL zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHe | Aug 5, 2022 | 9.8 | 41 | NO | NO |
CVE-2023-45853CRITICAL MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip | Oct 14, 2023 | 9.8 | 35 | NO | NO |
CVE-2016-9841CRITICAL inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. | May 23, 2017 | 9.8 | 35 | NO | NO |
CVE-2002-0059CRITICAL The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free" | Mar 15, 2002 | 9.8 | 35 | NO | NO |
CVE-2026-22184HIGH zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstr | Jan 7, 2026 | 7.8 | 34 | NO | NO |
CVE-2016-9843CRITICAL The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. | May 23, 2017 | 9.8 | 33 | NO | NO |
CVE-2016-9842HIGH The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. | May 23, 2017 | 8.8 | 33 | NO | NO |
CVE-2016-9840HIGH inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. | May 23, 2017 | 8.8 | 33 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (15 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
6.7% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (15 CVEs).
Media Mentions
Signals from CVEs in this product scope (15 CVEs).
Top CNAs Publishing CVEs For Zlib
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.2.2 | 2 | 6.3 | 4.7% | 0 | 0 |
| 1.2.1 | 2 | 4.8 | 3.0% | 0 | 0 |
| 1.2.0 | 1 | 7.5 | 5.5% | 0 | 0 |
| 1.1.4 | 1 | 7.5 | 26.0% | 0 | 1 |