CVE-2026-24793 is a critical (CVSS 9.8) buffer overflow in the zlib code bundled with AzerothCore, in inflate.c, affecting versions through v4.0.0. The project merged a pull request applying the upstream zlib fix. No fixed release number is stated, so check the project's releases.
What's affected
The record says AzerothCore azerothcore-wotlk through v4.0.0 is affected, in the deps/zlib module and the inflate.c file. A pull request in the project, titled as a fix for CVE-2022-37434 in a cloned function, says inflate() was cloned from zlib but did not receive the security patch, and applies the upstream fix. The pull request page shows it as merged.
I could not confirm which release first contains it. The record gives no fixed version, so check the project's release notes and your own checkout for the change.
How to check if you're exposed
Check whether your build uses the bundled zlib from the repository:
grep -rn "inflate" deps/zlib/inflate.c | head
Then compare your source tree with the merged pull request, number 21599 in the AzerothCore repository. If your server is built from a recent master that includes it, you have the change. If you run an older build, rebuild.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Pull the latest AzerothCore source that includes the zlib fix from pull request 21599, and rebuild.
- Check the project's release notes for the first release that contains it.
- Do not expose the game server to untrusted networks without the usual controls.
- Run the server as a low privilege user in a container or VM.
- Back up your database before a rebuild.
Why it matters
The record lists CWE-120, classic buffer overflow, and CWE-787, out-of-bounds write. The pull request describes the bug as a patched zlib flaw that survived in a copied function, which is a recurring supply chain problem: a library is vendored into a project, the upstream fix lands, and the copy never gets it.
Vendored code does not show up as a dependency in a lockfile, so version based scanning misses it. That makes an inventory of bundled third party code worth the effort. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Which release fixes it?
The record does not state one. Check the project's releases and the merged pull request.
Why do copied libraries cause this?
Because upstream fixes do not reach a vendored copy unless someone applies them by hand.
Sources
Last reviewed: 19 October 2026.
