zlib 1.4 fixes an 8 MB overwrite and a miniunz that could leave the extraction directory
zlib 1.4, with notes dated 4 November 2026 and published the next day, carries a buffer overflow in non-blocking gzwrite() (CVE-2026-85091), an inflateGetDictionary() overwrite of up to 8 MB past a caller's 32K buffer affecting 1.3.1 and 1.3.2, and minizip fixes including a miniunz that could create directories outside the extraction directory. CVE-2026-4738 in contrib/infback9 comes with the project's own caveat that the critical rating overstates it, and builders face a CMake 3.15 minimum plus libz naming on MSVC and Cygwin. The project's notes are the only source collected here, so no CVSS score is quoted.