CVE-2026-92000

Deferred Deferred - Pending Action

Memory Exhaustion in adm-zip via Zero-Size ZIP Entries

Publication date: 2026-09-15

Last updated on: 2026-09-24

Assigner: VulnCheck

Description

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-24

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-92000

Affected Vendors & Products

Vendor	Product	Version / Range
adm-zip	adm-zip	From 0.5.14 (inc) to 0.6.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

Detection Guidance

To detect this vulnerability, inspect ZIP archives processed by adm-zip versions 0.5.14 through 0.6.0 for entries declaring zero uncompressed size. Check for excessive memory usage during decompression. No specific commands are provided in the context.

Impact Analysis

This vulnerability can lead to denial of service by exhausting system memory. If exploited, it may crash applications or services using affected adm-zip versions, disrupting normal operations.

Mitigation Strategies

Immediately update adm-zip to a version outside the affected range (0.5.14-0.6.0). If updating is not possible, avoid processing untrusted ZIP archives or implement custom size limits during decompression.

Hi! I’m here to help you understand CVE-2026-92000. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70