CVE-2018-25032

7.5 high exploit ×3 SSVC exploitation: poc Modified

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

Fix

Public exploits 3

Satheesh575555/external_zlib-1.2.7_CVE-2018-25032 PoC on GitHub
Trinadh465/external_zlib_4.4_CVE-2018-25032 PoC on GitHub
Trinadh465/external_zlib_AOSP10_r33_CVE-2018-25032 PoC on GitHub

Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.

Patch, vendor advisory and mitigation references on NVD 10

https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531 Patch, Third Party Advisory
https://github.com/madler/zlib/compare/v1.2.11...v1.2.12 Patch, Third Party Advisory
https://github.com/madler/zlib/issues/605 Issue Tracking, Patch, Third Party Advisory
https://www.debian.org/security/2022/dsa-5111 Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531 Patch, Third Party Advisory
https://github.com/madler/zlib/compare/v1.2.11...v1.2.12 Patch, Third Party Advisory
https://github.com/madler/zlib/issues/605 Issue Tracking, Patch, Third Party Advisory
https://www.debian.org/security/2022/dsa-5111 Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 1

2026-10-15 00:45First seenCVSS 7.5 · nokogiri, python, zlibNVD modified 2026-10-14 07:16

Affected (CPE criteria) 51

cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:ruby:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-005:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-007:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-003:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_sc622-2c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_sc626-2c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_sc632-2c_firmware:*:*:*:*:*:*:*:*
and 11 more

References 64

http://seclists.org/fulldisclosure/2022/May/33 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/35 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/38 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/03/25/2 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/03/26/1 Exploit, Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf Third Party Advisory
https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531 Patch, Third Party Advisory
https://github.com/madler/zlib/compare/v1.2.11...v1.2.12 Patch, Third Party Advisory
https://github.com/madler/zlib/issues/605 Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/ Third Party Advisory
https://security.gentoo.org/glsa/202210-42 Third Party Advisory
https://security.netapp.com/advisory/ntap-20220526-0009/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20220729-0004/ Third Party Advisory
https://support.apple.com/kb/HT213255 Third Party Advisory
https://support.apple.com/kb/HT213256 Third Party Advisory
https://support.apple.com/kb/HT213257 Third Party Advisory
https://www.debian.org/security/2022/dsa-5111 Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/03/24/1 Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/03/28/1 Exploit, Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/03/28/3 Mailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/33 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/35 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2022/May/38 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/03/25/2 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/03/26/1 Exploit, Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf Third Party Advisory
https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531 Patch, Third Party Advisory
https://github.com/madler/zlib/compare/v1.2.11...v1.2.12 Patch, Third Party Advisory
https://github.com/madler/zlib/issues/605 Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/ Third Party Advisory
https://security.gentoo.org/glsa/202210-42 Third Party Advisory
https://security.netapp.com/advisory/ntap-20220526-0009/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20220729-0004/ Third Party Advisory
https://support.apple.com/kb/HT213255 Third Party Advisory
https://support.apple.com/kb/HT213256 Third Party Advisory
https://support.apple.com/kb/HT213257 Third Party Advisory
https://www.debian.org/security/2022/dsa-5111 Patch, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/03/24/1 Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/03/28/1 Exploit, Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2022/03/28/3 Mailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-333517.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html