CVE-2026-68924
Received Received - Intake

Disk Space Exhaustion in MobSF via Malicious ZIP

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but does not continue to the next member, so an authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-68924
EUVD
EUVD-2026-61131

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mobsf mobsf to 4.5.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-68924 is a Zip Bomb Denial of Service vulnerability in MobSF versions 4.5.0 and earlier. It occurs during ZIP/APK file extraction where MobSF checks for oversized files but fails to skip extraction after logging a warning. This causes malicious files to be written to disk, potentially exhausting disk space and preventing further scans.

Detection Guidance

Check MobSF logs for warnings about oversized ZIP/APK members during extraction. Monitor disk space usage during scans for unexpected consumption. Look for files exceeding 400 MB in MobSF's temporary or scan directories.

Impact Analysis

An attacker could upload a crafted ZIP or APK file with an oversized member (e.g., 450 MB) to MobSF. Despite a warning log, the file is extracted to disk, consuming storage space. This could prevent MobSF from performing further scans for other users due to disk exhaustion.

Mitigation Strategies

Upgrade MobSF to version 4.5.1 or later. Implement stricter file upload size limits in your web server or application. Regularly audit disk usage and scan logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68924. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart