SUSE-SU-2026:5138-1: Security update for zchunk

Q: Who is exposed to this issue?

Applications that use zchunk to process attacker-controlled or otherwise untrusted .zck files are exposed. The affected SUSE software includes zchunk and libzck1 packages in the SUSE Basesystem Module 15-SP7 for aarch64, ppc64le, s390x, and x86_64.

Q: What does an attacker need to exploit the flaw?

An attacker needs to provide a crafted .zck file to an application that processes it with the vulnerable code. Successful exploitation can cause the application to crash.

Q: How can I determine whether my system needs the update?

Check whether zchunk or libzck1 is installed from the SUSE Basesystem Module 15-SP7 on one of the listed architectures. Systems that process .zck files should prioritize applying SUSE-SU-2026:5138-1.

Published Nov 9, 2026

Updated

This update for zchunk fixes the following issue:

- CVE-2026-117556: heap out-of-bounds read in readpreface() allows attackers to cause an application crash via a crafted .zck file (bsc#1288144).

Other sources

This update for zchunk fixes the following issue: CVE-2026-117556: heap out-of-bounds read in readpreface() allows attackers to cause an application crash via a crafted .zck file (bsc#1288144).

— SUSE

Affected Software

8 affected componentsFixes available

suse/zchunk<1.5.1-150700.3.3.1

1.5.1-150700.3.3.1

All of the following

SUSE Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/zchunk-debugsource<1.5.1-150700.3.3.1

1.5.1-150700.3.3.1

suse/zchunk<1.5.1-150700.3.3.1

1.5.1-150700.3.3.1

suse/libzck1-debuginfo<1.5.1-150700.3.3.1

1.5.1-150700.3.3.1

suse/libzck-devel<1.5.1-150700.3.3.1

1.5.1-150700.3.3.1

suse/libzck1<1.5.1-150700.3.3.1

1.5.1-150700.3.3.1

suse/zchunk-debuginfo<1.5.1-150700.3.3.1

1.5.1-150700.3.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/zchunk to a version that resolves this vulnerability.
Fixed in 1.5.1-150700.3.3.1
Upgrade
Upgrade suse/zchunk-debugsource to a version that resolves this vulnerability.
Fixed in 1.5.1-150700.3.3.1
Upgrade
Upgrade suse/libzck1-debuginfo to a version that resolves this vulnerability.
Fixed in 1.5.1-150700.3.3.1
Upgrade
Upgrade suse/libzck-devel to a version that resolves this vulnerability.
Fixed in 1.5.1-150700.3.3.1
Upgrade
Upgrade suse/libzck1 to a version that resolves this vulnerability.
Fixed in 1.5.1-150700.3.3.1
Upgrade
Upgrade suse/zchunk-debuginfo to a version that resolves this vulnerability.
Fixed in 1.5.1-150700.3.3.1
Upgrade
Upgrade zchunk to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP7-2026-5138

Event History

Nov 9, 2026

Advisory Published

via OSV·01:00 PM

Data Sourced

via OSV·01:00 PM

DescriptionAffected Software

Advisory Published

via SUSE·01:00 PM

Data Sourced

via SUSE·01:00 PM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-117556

Frequently Asked Questions

Who is exposed to this issue?

Applications that use zchunk to process attacker-controlled or otherwise untrusted .zck files are exposed. The affected SUSE software includes zchunk and libzck1 packages in the SUSE Basesystem Module 15-SP7 for aarch64, ppc64le, s390x, and x86_64.

What does an attacker need to exploit the flaw?

An attacker needs to provide a crafted .zck file to an application that processes it with the vulnerable code. Successful exploitation can cause the application to crash.

How can I determine whether my system needs the update?

Check whether zchunk or libzck1 is installed from the SUSE Basesystem Module 15-SP7 on one of the listed architectures. Systems that process .zck files should prioritize applying SUSE-SU-2026:5138-1.

SUSE-SU-2026:5138-1: Security update for zchunk

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the flaw?

How can I determine whether my system needs the update?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the flaw?

How can I determine whether my system needs the update?