CVE-2026-111274

MediumCVSS 5.5

Published: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.

Risk Assessment

The vulnerability enables remote crashes of applications processing ZIP archives, which can be exploited for denial of service attacks.

Recommendation

Upgrade unarr beyond version 1.1.1 and fix the ZIP64 extra field length validation in the archive parser.

Other vulnerabilities in unarr

CVE-2026-111273Medium
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS