CVE-2026-111274
Received Received - Intake

Heap-based Out-of-Bounds Read in Unarr Library

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description
unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111274

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
selmf unarr 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap-based out-of-bounds read in the unarr library version 1.1.1. It occurs in the zip_parse_extra_fields() function due to an incorrect check of the ZIP64 extra field length. Attackers can exploit this by providing a specially crafted ZIP archive containing 0xFFFFFFFF sentinel values and a truncated ZIP64 record. This causes the program to read beyond the allocated heap memory, leading to crashes or potential data leaks.

Detection Guidance

This vulnerability can be detected by scanning for unarr versions prior to 1.1.2 or by inspecting ZIP archives processed by unarr for malformed ZIP64 extra fields. Check the version of unarr installed on your system using package managers like apt or yum.

Impact Analysis

If you use the unarr library in your software, this vulnerability could allow attackers to crash your application or potentially access sensitive data. Since it involves reading past heap buffers, there is a risk of information disclosure or denial-of-service attacks. Systems processing untrusted ZIP archives are particularly at risk.

Mitigation Strategies

Immediately update unarr to version 1.1.2 or later. If updating is not possible, avoid processing untrusted ZIP archives with unarr until patched. Monitor for crashes or memory corruption when handling ZIP files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart