SUSE CVE-2026-115909

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...

UBUNTU-CVE-2026-115909

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...

Linux Distros Unpatched Vulnerability : CVE-2026-115909

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls...

DEBIAN-CVE-2026-115909

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...

CVE-2026-115909

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...

CVE-2026-115909

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...

CVE-2026-115909

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...

EUVD-2026-109987

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::withcapacity for a symbolic link target using the attacker-controlled ZIP64 uncompressedsize before reading entry data. A small archive can...

CVE-2026-115907 zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path ...

CVE-2026-115907 zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path ...

CVE-2026-115907

The zip library for Rust (versions 5.1.0 through 9.0.0) is vulnerable to a denial of service when using the legacy-zip feature. Applications can experience a panic during ZipArchive::extract because the ShrinkDecoder (in src/legacy/shrink.rs), as well as the Reduce and Implode decoders, perform u...

PT-2026-123432

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed size before reading entry data. A small archive can...

CVE-2026-111274

unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the zzipparserootdirectory process. An attacker can cause the application to crash by supplying a specially crafted ZIP file with an entry name ending at the central directory end, which triggers a 28-byte ZIP64...

CVE-2026-111274 unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields

unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...

CVE-2026-111274

The software unarr through 1.1.1 is vulnerable to a heap-based out-of-bounds read within the zip_parse_extra_fields() function in zip/parse-zip.c. The root cause is an incorrect ZIP64 extra field length check . An attacker can exploit this by providing a crafted ZIP archive containing 0xFFFFFFFF ...

CVE-2026-111274 unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields

unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...

CVE-2026-111141 zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing

zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzipparserootdirectory in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central...

CVE-2026-111141

The zziplib library, versions through 0.13.80 , is vulnerable to an out-of-bounds read in the __zzip_parse_root_directory() function within zzip/zip.c. The flaw stems from an ineffective bounds check in mmap builds , which allows attackers to read past the mapped central directory. By providing a...

CVE-2026-111141 zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing

zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzipparserootdirectory in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central...