zlib 1.4 was released on 4 November 2026 (zlib.net current release; ChangeLog dated 4 Nov 2026) with a set of security fixes.

According to zlib.net, non-blocking gzwrite() had a buffer overflow tracked as CVE-2026-85091 (reported by mat-mo; also Trail of Bits TOB-ZLIB-003); contrib/infback9 out-of-bounds pointer arithmetic is tracked as CVE-2026-4738 (fix by npt-1707, submitted by CrossVR), which zlib says a critical rating overstates because pointers return in bounds before use though it could trap on capability hardware such as CHERI.

The same release also fixes, among others: inflateGetDictionary() writing past a 32K caller buffer on an invalid window size (Theorem THM-ZLIB-001; affects 1.3.1 and 1.3.2); inflateSync() window overrun (TOB-ZLIB-004); inflatePrime()/deflatePrime() bounds issues (TOB-ZLIB-014/013); inflateBack() copying uninitialized memory; gzseek() writing uninitialized memory on early forward seek; deflateResetKeep() mid-stream window read; several minizip issues including double free, NULL dereference, Zip64/extra-field and path-traversal problems; and gzdopen() close-on-exec.

Phoronix separately summarised the release on 5 November 2026 as shipping more than a dozen security fixes. No CVSS scores are stated on zlib.net. (source: zlib.net; zlib ChangeLog 1.4; Phoronix)