zlib 1.4 fixes buffer overflows and minizip path bugs

zlib 1.4 is available with fixes for more than a dozen security bugs in the core compression library and its minizip utilities. The issues range from buffer overflows and out-of-bounds reads in inflate and deflate paths to path traversal when extracting crafted zip archives.

CVE-2026-85091 covers a buffer overflow in non-blocking gzwrite(). Separately, inflateGetDictionary() could write up to 8 MB past a caller's 32K buffer after a zlib header with an invalid window size was followed by a reset or sync; that flaw affected 1.3.1 and 1.3.2. Other core problems included inflateSync() allocating a one-byte window that could later be overrun, inflatePrime() letting inflate read before the start of its input, and repeated deflatePrime() calls writing past the pending buffer.

inflateBack() failed to reject distances too far back and copied uninitialized memory to the output. Seeking forward with gzseek() before any data was written could emit uninitialized bytes into gzip output. deflateResetKeep() used mid-stream could read outside the window. gzdopen() now applies the correct close-on-exec flag.

In minizip, the release fixes a double free and a NULL dereference after a bad central directory, tightens extra-field and Zip64 parsing so crafted archives no longer yield different entry lists than other readers, and stops miniunz from creating directories outside the extraction tree or, on Windows, writing files to arbitrary locations. Path names are now handled component by component.

Alan Coopersmith summarized the fixes on the oss-security list. zlib underpins countless packages, so distributors and embedders are expected to pick up 1.4 promptly.