In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.
A flaw was found in zsh prior 5.4.2. There is a crash when copying empty hash table with typeset -p.
Resources: https://sourceforge.net/p/zsh/code/ci/c2cc8b0fbefc9868fa83537f5b6d90fc1ec438dd
Last updated 25 August 2025