CVE-2026-92000 in adm-zip
Summary
by MITRE • 09/15/2026
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability in adm-zip versions ranging from 0.5.14 through 0.6.0 represents a critical implementation flaw within the library's handling of zlib decompression streams, specifically concerning how it processes ZIP archive entries that declare an uncompressed size of zero. This issue stems from a failure to enforce strict output limits during the inflation process, which is the standard method for expanding compressed data in ZIP files. When a ZIP entry specifies a zero uncompressed size, many compression algorithms and parsers may interpret this as a signal to either skip processing or handle it with minimal overhead. However, adm-zip incorrectly proceeds with decompression without validating whether the actual output exceeds safe memory boundaries, relying instead on the metadata provided by the archive creator rather than monitoring the real-time expansion of data in memory.
This technical flaw allows attackers to craft malicious ZIP archives containing entries that are highly compressible yet declare a zero uncompressed size in their local file headers or central directory records. By exploiting this discrepancy between declared and actual sizes, an attacker can embed compressed data that expands into a significantly larger payload when decompressed. Since the library does not apply appropriate limits on the amount of memory allocated for the decompression buffer, the process continues until system resources are exhausted. This behavior effectively transforms a standard file extraction operation into a vector for resource exhaustion, as the application attempts to allocate increasingly large blocks of memory to accommodate the unexpectedly massive output stream generated by the zlib inflation routine.
The operational impact of this vulnerability is primarily focused on denial of service conditions within applications that utilize adm-zip to process user-uploaded or untrusted ZIP files. When a malicious archive is processed, the excessive memory consumption can lead to out-of-memory errors, application crashes, or system instability depending on the hosting environment and available resources. In cloud-native environments or serverless functions with strict memory limits, this could result in immediate termination of services, causing availability disruptions for end-users. Furthermore, if the decompressed data is subsequently written to disk without size validation, it may also lead to disk space exhaustion, compounding the denial of service effect and potentially affecting other processes sharing the same storage infrastructure.
To mitigate this risk, developers must upgrade adm-zip to a version that includes patches for proper input validation and output limit enforcement during decompression operations. It is essential to ensure that any ZIP processing logic implements strict checks on both declared uncompressed sizes and actual decompressed byte counts, rejecting entries where these values deviate significantly from expected norms or exceed predefined thresholds. Additionally, integrating defensive coding practices such as setting explicit memory limits for zlib streams and validating archive structures before extraction can prevent exploitation. Security teams should also consider implementing rate limiting and resource monitoring to detect anomalous memory usage patterns that may indicate ongoing attempts to exploit this vulnerability in production environments. This issue aligns with CWE-787, which addresses out-of-bounds write vulnerabilities due to improper limit enforcement, and reflects common pitfalls described in ATT&CK techniques related to resource exhaustion attacks where adversaries leverage software flaws to degrade service availability.