CVE-2026-111274 in unarr
Summary
by MITRE • 10/16/2026
unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in unarr versions through 1.1.1 represents a critical security flaw within the library's handling of ZIP archives, specifically located in the zip_parse_extra_fields function found in the parse-zip.c source file. This issue is classified as a heap-based out-of-bounds read, which falls under the Common Weakness Enumeration category CWE-125. The root cause lies in an incorrect validation logic regarding the length check for ZIP64 extra fields. Standard ZIP archives utilize specific data structures to store metadata and extended information about files contained within the archive. When dealing with larger archives or those containing large individual files, the format employs a specialized extension known as the ZIP64 format. This extension includes extra field records that provide additional details such as 64-bit offsets for file sizes and central directory locations. The vulnerability arises because the parser fails to correctly verify the boundaries of these extended fields before attempting to read their contents.
An attacker can exploit this flaw by constructing a maliciously crafted ZIP archive designed to trigger the erroneous code path. Specifically, the attack vector involves supplying an archive that contains 0xFFFFFFFF sentinel values within its headers alongside a truncated ZIP64 record. In standard ZIP parsing logic, the value 0xFFFFFFFF is often used as a placeholder indicating that the actual data resides in the corresponding ZIP64 extension field rather than the legacy four-byte field. However, due to the flawed length check, the parser does not adequately ensure that the extra field contains sufficient valid data before proceeding with the read operation. Consequently, when the library attempts to parse these fields, it reads memory locations beyond the allocated heap buffer boundaries. This out-of-bounds access allows the application to retrieve arbitrary data from adjacent memory regions or simply fail if those addresses are unmapped.
The operational impact of this vulnerability is primarily characterized by a denial of service condition resulting in process termination. When the program attempts to read from invalid memory addresses, it typically triggers a segmentation fault or similar fatal error, causing the unarr application to crash immediately upon processing the malicious archive. While heap-based out-of-bounds reads can sometimes lead to information disclosure if an attacker can carefully control and interpret the leaked data, in this specific context involving truncated records and sentinel values, the most immediate and reliable outcome is a stable denial of service against any system or user relying on unarr for automated extraction tasks. This poses a significant risk in environments where archives are processed from untrusted sources without prior sanitization, such as email gateways, file upload services, or continuous integration pipelines that automatically unpack incoming artifacts.
From an offensive security perspective, this vulnerability aligns with the ATT&CK technique of Initial Compromise via Drive-by Code Execution if exploited through a web interface, although it is more commonly associated with Denial of Service tactics in automated processing contexts. The lack of proper bounds checking on external input data highlights a fundamental gap in defensive programming practices regarding archive parsing libraries. To mitigate this risk, developers must update to patched versions of unarr where the zip_parse_extra_fields function has been corrected to enforce strict length validation for ZIP64 extra fields before any memory access occurs. Additionally, organizations should implement defense-in-depth strategies by validating input data at multiple layers and employing sandboxing techniques when processing potentially malicious archives from untrusted origins. Regular security audits focusing on buffer boundary checks in third-party libraries are essential to prevent similar exploitation vectors across the software supply chain.