ZeroDay Findings
Sign inSign up

Findings

CVE-2026-111141

zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped centr…

Published Oct 15, 2026 · updated Oct 16, 2026

zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · NIST NVD

    Detected

    zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the

  2. Oct 16, 2026 · OSV.dev

    Updated

    zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the

Affected

  • Debian:12 zziplib0.13.72+dfsg.1-1.1, 0.13.72+dfsg.1-1.2, 0.13.72+dfsg.1-1.2~exp1
  • Debian:13 zziplib0.13.78+dfsg.1-0.1, 0.13.78+dfsg.1-0.2
  • Debian:14 zziplib0.13.78+dfsg.1-0.1, 0.13.78+dfsg.1-0.2

Sources

  • CVE.orgVulnerability recordCVE-2026-111141

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-111141

    zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry na

    nvd.nist.gov
  • OSV.devPackage advisoryDEBIAN-CVE-2026-111141
    osv.dev

References