CVE-2026-115907
Received Received - Intake

Zip64 Uncompressed Size Overflow in Rust zip Library

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0, applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service. This issue is fixed in version 9.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115907
EUVD
EUVD-2026-109984

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zip-rs zip2 >= 5.1.0, < 9.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the zip Rust library versions 5.1.0 to 9.0.0. When the legacy-zip feature is enabled, attackers can exploit a flaw in the ZIP64 uncompressed size handling. The ShrinkDecoder, Reduce, and Implode decoders may reserve excessive output capacity before validating the compressed stream, leading to a capacity overflow panic during ZipArchive::extract. This can crash archive-processing services.

Impact Analysis

If you use an affected version of the zip library with the legacy-zip feature, an attacker could craft a malicious ZIP file to crash your application or service that processes archives. This could lead to denial of service, disrupting operations dependent on ZIP file handling.

Mitigation Strategies

Update the zip library to version 9.0.0 or later to address the vulnerability. If using Rust's zip crate, ensure the legacy-zip feature is disabled or the library is upgraded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart