Microsoft security update for CVE-2026-4176
🔗 CVE IDs covered (1)
📋 Microsoft's advisory
EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-4176. This page also shows what EchelonGraph holds for CVE-2026-4176, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.
🎯 Affected products33
- azl3 binutils 2.41-10 on Azure Linux 3.0
- azl3 boost 1.83.0-2 on Azure Linux 3.0
- azl3 cloud-hypervisor 48.0.246-4 on Azure Linux 3.0
- azl3 cmake 3.30.3-13 on Azure Linux 3.0
- azl3 erlang 26.2.5.18-1 on Azure Linux 3.0
- azl3 freetype 2.13.2-2 on Azure Linux 3.0
- azl3 gdb 13.2-6 on Azure Linux 3.0
- azl3 kata-containers 3.19.1.kata2-7 on Azure Linux 3.0
- azl3 libgit2 1.7.2-1 on Azure Linux 3.0
- azl3 nodejs24 24.13.0-3 on Azure Linux 3.0
- azl3 qtbase 6.6.3-4 on Azure Linux 3.0
- azl3 rsync 3.4.1-2 on Azure Linux 3.0
- azl3 rubygem-mini_portile2 2.8.4-1 on Azure Linux 3.0
- azl3 rust 1.75.0-27 on Azure Linux 3.0
- azl3 rust 1.90.0-6 on Azure Linux 3.0
- azl3 tcl 8.6.13-3 on Azure Linux 3.0
- azl4 nodejs24 1:24.22.1-5.azl4 on Azure Linux 4.0
- cbl2 boost 1.76.0-4 on CBL Mariner 2.0
- cbl2 ceph 16.2.10-11 on CBL Mariner 2.0
- cbl2 cloud-hypervisor 32.0-7 on CBL Mariner 2.0
- cbl2 cloud-hypervisor-cvm 38.0.72.2-5 on CBL Mariner 2.0
- cbl2 erlang 25.3.2.21-5 on CBL Mariner 2.0
- cbl2 freetype 2.13.1-2 on CBL Mariner 2.0
- cbl2 keras 2.11.0-3 on CBL Mariner 2.0
- cbl2 libgit2 1.6.5-1 on CBL Mariner 2.0
- cbl2 nmap 7.93-4 on CBL Mariner 2.0
- cbl2 nodejs18 18.20.3-12 on CBL Mariner 2.0
- cbl2 python-tensorflow-estimator 2.11.0-2 on CBL Mariner 2.0
- cbl2 rsync 3.4.1-2 on CBL Mariner 2.0
- cbl2 rubygem-mini_portile2 2.8.0-1 on CBL Mariner 2.0
- +3 more not shown
✅ Updates Microsoft lists: 1 update
1 row: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.
| KB article | Update | Fixed build |
|---|---|---|
| — | Security Update | — |
🧭 EchelonGraph on CVE-2026-4176
- EchelonGraph score
- 9.8 CRITICAL
- CISA KEV
- Not listed
- Fix status
- A fix is available — apply it.
Description from the CVE record (CVE.org), as published by its numbering authority
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.
Published by CPAN Security Group, the CVE Numbering Authority that assigned CVE-2026-4176, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).