Heap Out-of-Bounds Read Vulnerability in zchunk Product by zchunk
CVE-2026-117556

5.3MEDIUM

Key Information:

Vendor

Zchunk

Status
Zchunk
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117556?

The zchunk product prior to version 1.5.5 is susceptible to a heap out-of-bounds read vulnerability in the read_preface() function. This flaw allows attackers to craft malicious .zck files, with the potential to pass beyond the allocated heap header buffer. When such a crafted file is processed, it can lead to application crashes by reading data that extends past the expected boundaries, effectively jeopardizing the integrity and stability of systems using this software.

Affected Version(s)

zchunk 0 < 1.5.5

References

https://github.com/zchunk/zchunk/issues/119
issue-tracking
https://github.com/zchunk/zchunk
product
https://github.com/zchunk/zchunk/commit/02b371a64bf98245d...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.