i don’t know the full nature of the exploit, but zlib has an exploitable integer overflow via the MiniZip project. even though our images don’t use that project.

https://github.com/madler/zlib/issues/868