CVE-2018-25032: zlib deflate out-of-bounds write on distant matches

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityHigh CVSS (7.5) with network reachability and a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation.

What it is

zlib before 1.2.12 allows memory corruption when deflating (compressing) input that contains many distant matches, an out-of-bounds write (CWE-787). Because zlib is embedded in many products and language runtimes, the flaw affects a wide range of software that compresses attacker-influenced data.

Impact

An attacker can corrupt memory in the compressing process, which can crash it or potentially lead to code execution depending on the surrounding application and memory layout.

Attack surface

Reached remotely over the network with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), wherever an application compresses attacker-supplied data with a vulnerable zlib.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.51733, 98.9th percentile) and one reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade zlib to 1.2.12 or later, or apply the vendor patch for each affected product.
• Update bundled copies of zlib in language runtimes and libraries (for example Python and Nokogiri) and in firmware/appliances listed by vendors.
• Track vendor advisories (Debian, Fedora, Apple, NetApp, Siemens, MariaDB) and apply their fixed packages.
• Where patching is delayed, avoid compressing untrusted input with vulnerable zlib builds or isolate such processing.
• Inventory software that statically links zlib, since it will not be fixed by an OS package update alone.

Detection

• Monitor for crashes or abnormal termination in processes that perform zlib compression on untrusted data.
• Check installed zlib versions and bundled copies across hosts and containers against 1.2.12.
• Watch for memory-corruption indicators (ASAN/valgrind reports, segfaults) in services handling compressed input.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.