The vulnerability CVE-2026-22184 affects zlib software versions up to and including 1.3.1.2. It is a global buffer overflow (CWE-787) in the untgz utility located in the contrib/untgz directory. The issue arises when the untgz command is executed with an excessively long archive name provided via the command line, causing an out-of-bounds write in a fixed-size global buffer. This vulnerability is limited to the standalone demonstration utility and does not impact the core zlib compression library. There are no known exploits in the wild. The CVSS 4.0 base score is 4.6, indicating medium severity. No patch or official fix is currently referenced in the vendor advisory.

The vulnerability allows a local attacker to cause an out-of-bounds write by supplying an excessively long archive name to the untgz utility. This could potentially lead to memory corruption or application instability. However, the impact is limited because the flaw affects only the untgz demonstration utility and not the core zlib compression library. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects only the untgz standalone utility and not the core zlib library, users who do not use this utility are not impacted. For those using untgz, avoid processing archives with excessively long names or consider disabling use of the untgz utility until a fix is available. Monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-22184 for updates on patches or official fixes.