CVE-2026-111141
MediumCVSS 4.7Summary
zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c. An ineffective bounds check allows reading past the mapped central directory in mmap builds when a crafted ZIP entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads and crashing the process.
Risk Assessment
An attacker can supply a crafted ZIP file that crashes applications using zziplib (denial of service) or leaks memory data. The risk affects systems processing untrusted ZIP archives.
Recommendation
Update zziplib to a version containing the fix or avoid processing untrusted ZIP files until the patch is applied. Consider enabling additional memory protection mechanisms for archive-parsing processes.
Other vulnerabilities in zziplib
See all- CVE-2026-111142Medium
Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end.
- CVE-2018-17828Medium
Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.
Original NVD description (English source)
zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS