ZeroDay Findings
Sign inSign up

Findings

CVE-2026-6100

Use-after-free (UAF) was possible in the , , and when a memory allocation fails with a and the decompression instance is re-used.

Published Apr 13, 2026 · updated Aug 13, 2026

Use-after-free (UAF) was possible in the , , and when a memory allocation fails with a and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a is raised during decompression. Using the helper functions to one-shot decompress data such as , , , and are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 13, 2026 · NIST NVD

    Detected

    Use-after-free (UAF) was possible in the , , and when a memory allocation fails with a and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even afte

  2. Aug 13, 2026 · NIST NVD

    Updated

    Use-after-free (UAF) was possible in the , , and when a memory allocation fails with a and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even afte

Sources

  • CVE.orgVulnerability recordCVE-2026-6100

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-6100

    Use-after-free (UAF) was possible in the , , and when a memory allocation fails with a and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The

    nvd.nist.gov

References