CVE-2026-111274: unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields
unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger the issue?
They must cause the affected application to process a crafted ZIP archive. The archive uses 0xFFFFFFFF sentinel values together with a truncated ZIP64 extra-field record.
Is this exploitable remotely without user involvement?
The supplied severity vector identifies local attack access and user interaction as required. The data does not describe a network-reachable attack path.
What is the expected impact?
The out-of-bounds heap read can crash the process, resulting in a denial of service. The provided vector indicates no confidentiality or integrity impact.