CVE-2026-111142 in zziplib
Summary
by MITRE • 10/15/2026
Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Zziplib versions through 0.13.80 represents a critical out-of-bounds read flaw located within the mmapped.c module of the library. This security defect arises from insufficient boundary checks when processing ZIP archive central directory structures, specifically during the parsing of end-of-central-directory records. The core technical issue involves the function zzip_disk_entry_strdup_name, which is responsible for extracting and duplicating file names stored in the archive metadata. When a maliciously crafted ZIP file presents an end-of-central-directory record that positions the first entry structure near or at the very end of the allocated memory buffer, the library fails to verify whether sufficient data remains within the valid memory bounds before attempting to read the filename string. This lack of validation allows the application to perform a heap-based over-read operation, accessing memory locations beyond the intended allocation limits defined by the ZIP file's internal structure.
From an operational perspective, this vulnerability primarily manifests as a denial-of-service condition due to immediate application crashes or segmentation faults when the out-of-bounds read triggers a protection fault in modern operating systems. However, depending on the specific compiler optimizations and memory layout of the target environment, such heap over-reads can potentially lead to information disclosure if the accessed adjacent memory contains sensitive data that is subsequently processed or leaked through error messages or logging mechanisms. The attack vector requires an attacker to supply a specially constructed ZIP archive, which could be delivered via email attachments, file upload interfaces, or any application context where Zziplib is utilized for decompression tasks. This makes it particularly relevant in scenarios involving user-uploaded content processing, automated document scanning systems, and software distribution mechanisms that unpack compressed archives without prior validation of their structural integrity.
This flaw aligns with Common Weakness Enumeration (CWE) category CWE-125, which describes Out-of-bounds Read vulnerabilities where a program reads data past the end or before the beginning of the intended buffer. In terms of offensive security frameworks, this vulnerability can be leveraged within MITRE ATT&CK technique T1083, File and Directory Discovery, if the crash behavior is manipulated to leak memory contents that reveal system paths or sensitive file names. Furthermore, it relates to CWE-20, Improper Input Validation, as the library fails to adequately sanitize and validate the structural parameters of the incoming ZIP archive before processing its internal entries. The root cause lies in the assumption that the central directory structures are well-formed and contained within expected limits, a dangerous presumption when dealing with untrusted input sources.
Mitigation strategies for this vulnerability involve immediate updates to Zziplib version 0.13.81 or later, where developers have implemented stricter boundary checks during the parsing of ZIP central directories. For environments unable to upgrade immediately, defensive programming practices should be adopted by wrapping library calls in try-catch blocks if supported by the language interface, although this may not prevent crashes from segmentation faults caused by illegal memory access. Additionally, input validation layers at the application level can inspect incoming archive files for structural anomalies before passing them to the decompression engine. Security teams should also consider implementing sandboxing or containerization for processes that handle untrusted archives to limit the blast radius of potential exploits. Regular security audits focusing on third-party library usage and fuzz testing of compression libraries are recommended to detect similar boundary condition flaws in other components of the software supply chain.