Z.ai discloses 2,436 vulnerabilities spanning 45 years with average 26.6-year latency

Z.ai’s disclosure aggregates 2,436 vulnerabilities across open-source and proprietary software, revealing a pattern of long-undetected flaws. The dataset includes 53 publicly disclosed vulnerabilities, while 1,097 remain undisclosed, suggesting a broader backlog of latent risks. The 26.6-year average latency between introduction and discovery indicates that many vulnerabilities persist through multiple generations of software development and deployment cycles.

The severity distribution shows 107 critical and 990 high-severity vulnerabilities, with the remainder split between medium and low risk. These flaws affect foundational components like the Linux kernel, WebKit, and FreeBSD, which are embedded in countless systems. The inclusion of projects like GStreamer and Joomla extends the impact to multimedia processing and web applications, respectively, demonstrating how deeply these vulnerabilities permeate modern software stacks.

The 45-year span of affected code underscores the challenge of maintaining security in long-lived systems. Many of these vulnerabilities likely evaded detection due to limited tooling, incomplete audits, or assumptions about code stability. For engineers, this disclosure signals the need to reassess trust in legacy components, even those presumed stable. The latency also raises questions about the effectiveness of current vulnerability management practices, particularly in open-source projects with distributed maintenance.

The disclosed vulnerabilities include use-after-free errors, memory corruption, and input validation failures, classic bug classes that remain prevalent despite decades of awareness. Examples like the Linux kernel’s 6lowpan flaw or FreeBSD’s ptrace issue show how low-level systems code continues to harbor critical risks. The Suricata SMTP parsing bug and Joomla XSS vulnerability further illustrate how higher-level protocols and frameworks are equally susceptible to long-standing design oversights.

This disclosure serves as a forcing function for organizations to prioritize deeper code audits, especially for components with multi-decade lifespans. The cost of adoption includes not only patching but also verifying the absence of similar latent flaws in related codebases. Where it stops working is in systems that cannot be updated or audited, such as embedded devices or abandoned projects, leaving residual risk that may persist indefinitely.