CVE-2026-111141
published 2026-10-15CVE-2026-111141: zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the…
PriorityP419medium4.7CVSS 3.1
AVLACHPRNUIRSUCNINAH
EPSS
0.12%
1.9th percentile
zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gdraheim | zziplib | <= 0.13.80 | — |
| gdraheim | zziplib | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv4.05.7MEDIUMCVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due t
ghsa_unreviewed·2026-10-15
CVE-2026-111141 [MEDIUM] CWE-125 zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due t
zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.
Red Hat
zziplib: zziplib: Denial of Service via out-of-bounds read in central directory parsing
vendor_redhat·2026-10-15·CVSS 4.7
CVE-2026-111141 [MEDIUM] CWE-125 zziplib: zziplib: Denial of Service via out-of-bounds read in central directory parsing
zziplib: zziplib: Denial of Service via out-of-bounds read in central directory parsing
A flaw was found in zziplib. An attacker could exploit this vulnerability by providing a specially crafted ZIP archive to an application utilizing the library. An ineffective bounds check during the parsing of the central directory causes the library to read past allocated memory, resulting in an application crash and Denial of Service (DoS).
Package: zziplib (Red Hat Enterprise Linux 10) - Fix deferred
Package: zziplib (Red Hat Enterprise Linux 7) - Fix deferred
Package: zziplib (Red Hat Enterprise Linux 8) - Fix deferred
Package: zziplib (Red Hat Enterprise Linux 9) - Fix deferred
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-111141 zziplib: zziplib: Denial of Service via out-of-bounds read in central directory parsing [fedora-all]
bugzilla·2026-10-16·CVSS 4.7
CVE-2026-111141 [MEDIUM] CVE-2026-111141 zziplib: zziplib: Denial of Service via out-of-bounds read in central directory parsing [fedora-all]
CVE-2026-111141 zziplib: zziplib: Denial of Service via out-of-bounds read in central directory parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.
Bugzilla
CVE-2026-111141 zziplib: zziplib: Denial of Service via out-of-bounds read in central directory parsing
bugzilla·2026-10-15·CVSS 4.7
CVE-2026-111141 [MEDIUM] CVE-2026-111141 zziplib: zziplib: Denial of Service via out-of-bounds read in central directory parsing
CVE-2026-111141 zziplib: zziplib: Denial of Service via out-of-bounds read in central directory parsing
zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.
https://github.com/gdraheim/zziplibhttps://github.com/gdraheim/zziplib/blob/f58313c1f65f46bf73f3526d1afd4d6bb46cc4ae/zzip/zip.c#L530-L558https://hackmd.io/@haind-pwn/zziplib-zip-central-directory-oob-readhttps://www.vulncheck.com/advisories/zziplib-through-0.13.80-out-of-bounds-read-via-zzip-parse-root-directory-zip64-parsing
2026-10-15
Published