Out-of-Bounds Read Vulnerability in zziplib by zzip
CVE-2026-111141
5.7MEDIUM
What is CVE-2026-111141?
zziplib versions up to 0.13.80 have a security vulnerability that allows for out-of-bounds reading. The issue is found in the __zzip_parse_root_directory() function within zzip/zip.c. Attackers can exploit this vulnerability by providing a specially crafted ZIP file that triggers buffer over-reads, leading to potential crashes of the application. The flaw occurs because the bounds check is insufficient, permitting access to memory beyond the mapped central directory when using mmap builds.
Affected Version(s)
zziplib 0 <= 0.13.80
References
CVSS V4
Score:
5.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology