Out-of-Bounds Read Vulnerability in Zziplib Affects Multiple Versions

CVE-2026-111142

What is CVE-2026-111142?

Zziplib, up to version 0.13.80, is vulnerable to an out-of-bounds read issue in its handling of ZIP files. Specifically, the vulnerability exists in the zzip/mmapped.c file, where attackers can manipulate the ZIP central directory to over-read heap memory. By crafting a malicious end-of-central-directory record, an attacker can position the first entry near the buffer's limit, resulting in unauthorized memory access. This can lead to application crashes and potential data leakage, highlighting the importance of applying proper validation and sanitization in memory handling.

References