USN-8954-1: Ubuntu patches zlib buffer overflow on 24.04, 26.04 and 26.10

Canonical published security advisory USN-8954-1 on 22 October 2026, addressing a vulnerability in zlib on Ubuntu 24.04 LTS, 26.04 LTS and 26.10. Ubuntu server administrators should schedule the update: zlib is the compression library used by practically every stack — PHP, nginx, Apache, OpenSSH, backup tools — so the impact surface is broad, even though exploitation requires specific conditions.

What the advisory says

The official advisory notes that zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary. The flaw is tracked as CVE-2026-85091.

The severity score varies depending on the source: NVD classifies it as 7.4 High, whilst the Ubuntu advisory reports a higher score of 8.3 High, calculated using CVSS v4.0. Exploitation requires a specific application context: the most probable attack vector is a local or embedded context where an application can invoke the vulnerable zlib API; maintaining stale external buffer pointers across non-blocking writes is necessary for exploitation.

It's worth noting that the fix was not released immediately: until mid-September 2026, Ubuntu reported the flaw as lacking an upstream patch, with "fix deferred" status on all supported releases, awaiting the zlib developers to release a fix.

Affected packages and corrected versions

Release	Affected packages	Corrected version
Ubuntu 26.10 (stonking)	zlib1g, zlib1g-dev, lib32z1, lib64z1, libx32z1 and respective -dev	1:1.3.dfsg+really1.3.2-3ubuntu1.1
Ubuntu 26.04 LTS (resolute)	zlib1g, zlib1g-dev, lib32z1, lib64z1, libx32z1 and respective -dev	1:1.3.dfsg+really1.3.1-1ubuntu3.2
Ubuntu 24.04 LTS (noble)	zlib1g, zlib1g-dev, lib32z1, lib64z1, libx32z1 and respective -dev	1:1.3.dfsg-3.1ubuntu2.3

How to update

A normal system update applies the fix:

sudo apt update && sudo apt upgrade

After updating, services that load zlib dynamically (nearly all of them) should be restarted to load the new library; on a production server it's advisable to schedule a restart of key processes (web server, PHP-FPM, database) or, if they cannot be stopped, a full reboot during the next maintenance window.