CVE-2026-115909

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...

EUVD-2026-109987

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...

CVE-2026-115907

The zip library for Rust (versions 5.1.0 through 9.0.0) is vulnerable to a denial of service when using the legacy-zip feature. Applications can experience a panic during ZipArchive::extract because the ShrinkDecoder (in src/legacy/shrink.rs), as well as the Reduce and Implode decoders, perform u...

CVE-2026-111274

unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...

CVE-2026-111274

The software unarr through 1.1.1 is vulnerable to a heap-based out-of-bounds read within the zip_parse_extra_fields() function in zip/parse-zip.c. The root cause is an incorrect ZIP64 extra field length check . An attacker can exploit this by providing a crafted ZIP archive containing 0xFFFFFFFF ...

CVE-2026-111274 unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields

unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...

CVE-2026-111141 zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing

zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzipparserootdirectory in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central...

CVE-2026-111141

The zziplib library, versions through 0.13.80 , is vulnerable to an out-of-bounds read in the __zzip_parse_root_directory() function within zzip/zip.c. The flaw stems from an ineffective bounds check in mmap builds , which allows attackers to read past the mapped central directory. By providing a...

GHSA-FW94-4WWP-W8PW Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

Summary A Zip64 uncompressed-size of 2^63 casts to a negative int64 that bypasses the unzip-size guard and reaches makebyte, 0, negativeCap A Zip64 uncompressed-size in the range 2^63, 2^64 casts to a negative int64 in zip.File.FileInfo.Size, and ReadZipReader does signed arithmetic on that value...

Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

Summary A Zip64 uncompressed-size of 2^63 casts to a negative int64 that bypasses the unzip-size guard and reaches makebyte, 0, negativeCap A Zip64 uncompressed-size in the range 2^63, 2^64 casts to a negative int64 in zip.File.FileInfo.Size, and ReadZipReader does signed arithmetic on that value...

CVE-2026-107224

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 throu...

CVE-2026-107224 Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 throu...

CVE-2026-107224 Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 throu...

EUVD-2026-94555

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 throu...

CVE-2026-107224 Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 throu...

CVE-2026-107224

The Excelize Go library (versions 2.1.0 to 2.11.0 ) is vulnerable to a panic during workbook opening due to an integer overflow/wraparound . When a crafted Zip64 entry declares an uncompressed size between $2^{63}$ and $2^{64}-1$, the library converts the uint64 value into a negative int64. This ...

CVE-2026-107224: Integer Overflow or Wraparound

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and allocation. ReadZipReader obtains UncompressedSize64 throu...

SUSE CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...

fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...