CVE-2026-39244

HighCVSS 7.5

Published: 10/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 11/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

The adm-zip library before version 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. An attacker can create a small ZIP file (about 120 bytes) declaring an uncompressed size of 4 GB, leading to memory allocation amplification of over 33 million to 1, causing a process crash.

Risk Assessment

The organization is at risk of immediate application crash when processing untrusted ZIP files using adm-zip. The attack can be performed remotely without authentication, leading to memory exhaustion and system failure.

Recommendation

Update adm-zip to version 0.5.18 or later immediately. If an update is not possible, implement validation of the uncompressed size before processing ZIP files.

Other vulnerabilities in adm-zip

CVE-2026-76845Medium
adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines.

Original NVD description (English source)

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.