Critical zlib Flaw Let Attackers Can Trigger a Buffer Overflow via untgz

A severe global buffer overflow was identified in the zlib untgz utility (version 1.3.1.2) where TGZfname() uses strcpy() to copy an argv-supplied archive name into a fixed 1024-byte global buffer without bounds checking. Security researchers reproduced the issue with AddressSanitizer using a 4096-byte input (ASAN reported a 2001-byte write), and the flaw is trivially exploitable via a long command-line filename; impacts range from crashes and memory corruption to potential arbitrary code execution depending on build and runtime conditions.