Description
Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.
Published: 2026-10-15
Score: 6.8 Medium
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.
Title Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst
First Time appeared Gdraheim
Gdraheim zziplib
Weaknesses CWE-125
CPEs cpe:2.3:a:gdraheim:zziplib:*:*:*:*:*:*:*:*
Vendors & Products Gdraheim
Gdraheim zziplib
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Gdraheim Zziplib
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T18:57:33.992Z

Reserved: 2026-10-15T17:03:57.191Z

Link: CVE-2026-111142

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-15T19:17:28.417

Modified: 2026-10-15T19:17:28.417

Link: CVE-2026-111142

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses