CVE-2026-22184: 
NixOS vulnerability analysis and mitigation

CVE-2026-22184 is a global buffer overflow vulnerability in the untgz demonstration utility bundled with zlib versions up to and including 1.3.1.2. The flaw resides in the TGZfname() function within contrib/untgz/untgz.c, which performs an unbounded strcpy() of a user-supplied archive name into a fixed-size 1024-byte static global buffer. Importantly, the vulnerability is disputed and scoped to the standalone untgz demo utility — it does not affect the core zlib compression library. It was first reported via Full Disclosure on December 29, 2025, and assigned a CVE on January 7, 2026. NIST NVD rates it CVSS v3.1 7.8 (High) with a local attack vector, while the assigning CNA (VulnCheck) rates it CVSS v4.0 4.6 (Medium) (VulnCheck Advisory, GitHub Issue).

The root cause is classified as CWE-787 (Out-of-bounds Write) and CWE-120 (Buffer Copy without Checking Size of Input). In TGZfname(), the archive name is taken directly from argv[] and copied into a 1024-byte static global buffer via an unchecked strcpy() call — no length validation is performed before or during the copy. Because the vulnerable buffer is globally allocated (not stack-allocated), an overflow corrupts adjacent global memory objects rather than a stack frame, and the overflow occurs before any archive parsing or validation takes place. Exploitation requires only passing an archive name argument longer than 1024 bytes on the command line, as demonstrated with AddressSanitizer output showing a WRITE of size 2001 at the global buffer address (GitHub Issue, Full Disclosure).

Successful exploitation can result in memory corruption of adjacent global objects, denial of service via crash, and potentially arbitrary code execution depending on compiler, build flags, architecture, and memory layout. Because the overflow affects global memory, corruption may persist beyond the function scope and influence subsequent program behavior. The impact is confined to systems where the untgz utility is compiled and invoked directly; the core zlib library used by the vast majority of applications is unaffected (VulnCheck Advisory, GitHub Issue).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.081%, reflecting low probability of near-term exploitation. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to invoke the untgz utility with a crafted argument, significantly limiting the attack surface. The CVE is marked as disputed in NVD, reflecting debate about the severity given the utility's demo-only nature (VulnCheck Advisory, GitHub Issue).

1. Identify target: Confirm the target system has the untgz utility compiled from zlib's contrib/untgz/ directory (version ≤ 1.3.1.2). This utility is not installed by default on most systems and must be explicitly built.
2. Craft oversized argument: Prepare an archive name string exceeding 1024 bytes (e.g., using Python: python3 -c "print('A' * 4096)").
3. Invoke the utility: Execute ./untgz <oversized_string>, passing the crafted string as the archive name argument on the command line.
4. Trigger overflow: The TGZfname() function immediately copies the argument into the 1024-byte static global buffer via strcpy() without bounds checking, causing an out-of-bounds write into adjacent global memory.
5. Achieve impact: Depending on compiler, build flags, and memory layout, the result may be a crash (DoS), memory corruption of adjacent global variables, or potentially code execution (GitHub Issue, Full Disclosure).

• Process: Unexpected crash or abnormal termination of the untgz process; AddressSanitizer or similar runtime error output referencing TGZfname in untgz.c:136.
• Logs: System logs (e.g., /var/log/syslog, dmesg) showing segmentation faults or memory corruption errors from the untgz binary.
• File System: Presence of a compiled untgz binary in non-standard locations, particularly if the system does not normally use zlib's contrib utilities.
• Command History: Shell history entries showing invocation of untgz with unusually long arguments (>1024 characters).

The zlib project released version 1.3.2 (February 2026) and 1.3.2.1, which should be evaluated for fixes; users should monitor the zlib GitHub repository for patch status specific to the untgz utility. As an immediate workaround, restrict or remove the compiled untgz binary from systems where it is not operationally required, since it is a demo utility not intended for production use. Input validation limiting archive name arguments to fewer than 1024 bytes can also mitigate the flaw. IBM has issued a security bulletin for IBM Instana Observability products affected by this vulnerability in the Instana Agent container image (IBM Advisory). Mageia and Fedora have also issued distribution-level advisories addressing this CVE (Linux Security Mageia).

Heise reported on the vulnerability under the headline "zlib: Critical security vulnerability allows code smuggling — no update yet," reflecting initial concern about the lack of an immediate patch (Heise). Security Online Info covered it with a CVSS 9.3 framing (based on VulnCheck's original pre-revision score), which generated notable community discussion on Reddit and Mastodon about the severity discrepancy between the original and revised scores. The CVE was subsequently marked as disputed in NVD after VulnCheck revised the description to clarify the utility's demo-only scope and downgraded the CVSS scores, which tempered broader alarm. The Hacker News weekly recap included it among notable vulnerabilities, and multiple Linux distribution security teams (Mageia, Fedora, openSUSE) issued advisories, indicating broad ecosystem awareness.