CVE-2018-25032
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Published Mar 25, 2022 · updated Oct 15, 2026 · nokogiri nokogiri
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 25, 2022 · NIST NVD
Detected
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Oct 14, 2026 · NIST NVD
Updated
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Oct 14, 2026 · OSV.dev
Fix available
libz-mingw-w64 fixed in 1.2.11+dfsg-5; libz-mingw-w64 fixed in 1.2.11+dfsg-5; libz-mingw-w64 fixed in 1.2.11+dfsg-5; zlib fixed in 1:1.2.11.dfsg-4
Oct 14, 2026 · OSV.dev
Fix available
libz-mingw-w64 fixed in 1.2.11+dfsg-5
Oct 14, 2026 · OSV.dev
Fix available
zlib fixed in 1:1.2.11.dfsg-4
Oct 14, 2026 · OSV.dev
Updated
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Oct 14, 2026 · OSV.dev
Updated
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Oct 15, 2026 · OSV.dev
Updated
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Affected
- Debian:12 libz-mingw-w640 → 1.2.11+dfsg-5
- Debian:12 zlib0 → 1:1.2.11.dfsg-4
- Debian:13 libz-mingw-w640 → 1.2.11+dfsg-5
- Debian:13 zlib0 → 1:1.2.11.dfsg-4
- Debian:14 libz-mingw-w640 → 1.2.11+dfsg-5
- Debian:14 zlib0 → 1:1.2.11.dfsg-4
- cpe apple/mac os xversion unspecified
- cpe debian/debian linux10.0
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora34
- cpe mariadb/mariadbversion unspecified
- cpe netapp/active iq unified managerversion unspecified
- cpe nokogiri/nokogiriversion unspecified
- cpe python/pythonversion unspecified
- cpe zlib/zlibversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2018-25032
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2018-25032
30-day exploitation probability 51.7%
first.org - NIST NVDVulnerability recordCVE-2018-25032
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
nvd.nist.gov - OSV.devPackage advisoryDEBIAN-CVE-2018-25032osv.dev