CVE-2026-111141

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in zziplib ZIP Archive Parser

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111141

EUVD

EUVD-2026-102268

Affected Vendors & Products

Vendor	Product	Version / Range
gdraheim	zziplib	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-111141 is an out-of-bounds read vulnerability in zziplib through version 0.13.80. It occurs in the __zzip_parse_root_directory function when parsing ZIP64 extra fields. The issue stems from an incorrect bounds check that allows reading up to 28 bytes past the mapped central directory in mmap builds. Attackers can exploit this by crafting a ZIP file where the entry name ends at the directory boundary, triggering a crash or exposing adjacent memory.

Detection Guidance

To detect this vulnerability, inspect systems using zziplib versions up to 0.13.80, particularly those built with autotools and --enable-mmap. Check for crashes when processing ZIP files or unusual memory reads. Use tools like 'strings' or 'hexdump' on suspicious ZIP files to analyze entry names and central directory boundaries.

Impact Analysis

This vulnerability can cause applications using zziplib to crash when processing maliciously crafted ZIP files. It may also expose sensitive data in memory or lead to denial-of-service conditions. Systems using autotools builds with --enable-mmap are particularly affected, while CMake builds are safe by default.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It is an out-of-bounds read issue in zziplib that could lead to crashes or unintended data exposure when processing crafted ZIP files. Compliance impacts would depend on how the library is used in a system handling sensitive data.

Mitigation Strategies

Upgrade zziplib to a patched version beyond 0.13.80. If using autotools builds, disable mmap with --disable-mmap. Avoid processing untrusted ZIP files. Monitor systems for crashes or memory corruption when handling ZIP archives.

Hi! I’m here to help you understand CVE-2026-111141. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70