CLEANSTART-2026-DX69045: When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion
Security vulnerability affects the miniforge3 package. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 26.1.1.3-r4 - Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 26.3.2.3-r6
Frequently Asked Questions
Who is exposed to this issue?
Systems using the affected miniforge3 package are exposed when they decompress crafted ZIP files that use bzip, LZMA, or Zstandard compression. The attacker must be able to supply or induce processing of such a ZIP file.
What is the likely impact of successful exploitation?
A crafted archive can cause Python to pre-allocate memory based on an attacker-controlled size, potentially exhausting available memory. The reported impact is limited to availability.
Does exploitation require user interaction?
Yes. The supplied severity vector indicates user interaction is required. The data does not specify what form that interaction takes.