CVE-2026-111141: zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing
zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzipparserootdirectory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzipdiropen() that crash the process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects zziplib through 0.13.80 when built with mmap support. The vulnerable path is reached when ZIP archives are opened through zzip_dir_open().
What does an attacker need to trigger the crash?
An attacker needs to provide a crafted ZIP archive whose central-directory entry name ends at the central-directory boundary and causes ZIP64 extra-field parsing. User interaction is required according to the supplied CVSS vector, and no privileges are required.
What is the expected impact of successful exploitation?
The out-of-bounds read can read past the mapped central directory and crash the process, resulting in a denial of service. The provided vector indicates no confidentiality or integrity impact.