CVE-2026-117556 in zchunk
Summary
by MITRE • 10/27/2026
zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in zchunk versions prior to 1.5.5 represents a critical memory safety flaw located within the library's core parsing logic for chunked archive headers. Specifically, the defect resides in the read_preface function found in src/lib/header.c, which is responsible for interpreting the initial metadata of .zck files. This component plays a pivotal role in establishing the context for subsequent data decompression and integrity verification processes. The root cause of this vulnerability stems from an incorrect calculation during the parsing of compressed integers within the header structure. When processing these variable-length encoded values, the function erroneously passes the total length of the entire header to internal compression integer parsing routines rather than passing only the remaining bytes available in the current buffer context. This logical error fundamentally misaligns the boundary checks and read operations performed by the underlying decompression algorithms.
From a technical perspective, this miscalculation leads directly to a heap out-of-bounds read condition. Because the parser believes there are more valid bytes available than actually exist within the allocated header buffer, it proceeds to access memory locations beyond the intended allocation boundary. An attacker can exploit this flaw by constructing a malicious .zck file where the structural end of the header coincides precisely with or falls inside a compressed integer sequence. When zchunk processes such a crafted input, the parsing functions attempt to read data from heap memory that has not been allocated for the header structure. This unauthorized access results in reading arbitrary stack or heap contents depending on the surrounding memory layout, which typically manifests as an application crash due to segmentation faults or invalid memory access violations.
The operational impact of this vulnerability is primarily centered around denial of service against applications that utilize zchunk for handling chunked data streams. While the immediate effect observed is a crash, the nature of heap out-of-bounds reads also introduces potential information disclosure risks if an attacker can carefully control the surrounding memory state to leak sensitive data from adjacent allocations. However, in most standard usage scenarios involving untrusted input sources such as package managers or update servers, the primary consequence remains system instability and service interruption. This flaw undermines the reliability of systems relying on zchunk for efficient delta updates or large file transfers, potentially causing critical services to become unavailable until a restart occurs.
This vulnerability aligns with Common Weakness Enumeration standard CWE-125, which describes out-of-bounds read errors resulting from improper boundary validation during memory access operations. In the context of the MITRE ATT&CK framework, this exploit technique falls under Tactic TA0004 (Privilege Escalation) or more accurately TA0006 (Credential Access/Discovery) if information leakage is achieved, but primarily it represents a disruption vector within TA0040 (Impact). The specific mechanism of supplying crafted input to trigger memory corruption corresponds to techniques often associated with fuzzing attacks designed to uncover logic errors in parser implementations.
To mitigate this risk, organizations and developers must immediately upgrade zchunk to version 1.5.5 or later where the header parsing logic has been corrected to properly calculate remaining byte counts for compressed integer processing. Input validation strategies should also be implemented at higher-level application layers to ensure that any .zck files processed by the system are validated against known good structural parameters before being passed to the library functions. Additionally, enabling compiler-based protections such as AddressSanitizer during development and testing phases can help detect similar boundary violations in future code changes. Regular security audits of third-party dependencies used for data compression and archival operations remain essential to maintaining robust defense-in-depth postures against parser-related vulnerabilities.