Buffer overflow in zlib - CVE-2026-27820

Vulnerability identifier: #VU126646

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-27820

CWE-ID: CWE-120

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to buffer overflow in zstream_buffer_ungets() function when parsing input within the Zlib::GzipReader. A remote attacker can provide crafted input that causes the buffer length to exceed its capacity to cause memory corruption.

User interaction is required.

zlib
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Basesystem Module
ruby2.5-debuginfo
ruby2.5
libruby2_5-2_5
ruby2.5-debugsource
ruby2.5-devel
ruby2.5-devel-extra
libruby2_5-2_5-debuginfo
ruby2.5-stdlib
ruby2.5-stdlib-debuginfo

Install security update from vendor's website.

zlib - addressed in versions 3.0.1, 3.1.2, 3.2.3
ruby2.5-debuginfo - update to 2.5.9-150700.24.6.1
ruby2.5 - update to 2.5.9-150700.24.6.1
libruby2_5-2_5 - update to 2.5.9-150700.24.6.1
ruby2.5-debugsource - update to 2.5.9-150700.24.6.1
ruby2.5-devel - update to 2.5.9-150700.24.6.1
ruby2.5-devel-extra - update to 2.5.9-150700.24.6.1
libruby2_5-2_5-debuginfo - update to 2.5.9-150700.24.6.1
ruby2.5-stdlib - update to 2.5.9-150700.24.6.1
ruby2.5-stdlib-debuginfo - update to 2.5.9-150700.24.6.1

• https://www.ruby-lang.org/en/news/2026/03/05/buffer-overflow-zlib-cve-2026-27820/
• https://github.com/ruby/zlib/security/advisories/GHSA-g857-hhfv-j68w

• Buffer overflow in Ruby Zlib gem
• SUSE update for ruby2.5