zziplib CVE-2026-111141

Exploitation requires three concrete conditions: (1) the target application must use a zziplib build compiled in mmap mode - standard (read)-mode builds that do not memory-map the archive are not affected; (2) the victim application must open an attacker-supplied archive via zzip_dir_open(), i.e. passive user/application interaction (UI:P) is required; and (3) the ZIP must be specifically crafted so an entry name ends exactly at the end of the mapped central directory, causing the 28-byte ZIP64 extra-field parse to read out of bounds. Limiting factors: local attack vector (AV:L) means the malicious file must be delivered to and processed locally; high complexity (AC:H) and the attack requirement (AT:P) reflect the precise archive layout needed; and the only outcome is a crash (availability impact), with no confidentiality or integrity impact.

The provided CVSS 4.0 base score is 5.7 (medium) with vector AV:L/AC:H/AT:P/PR:N/UI:P and impact limited to availability (VA:H; VC:N, VI:N). This is a denial-of-service (process crash) via out-of-bounds read, not code execution or data disclosure, which caps the real-world severity. Multiple signals point to low operational priority: the attack vector is LOCAL (AV:L) rather than network, attack complexity is HIGH (AC:H) with an additional attack requirement (AT:P), and passive user interaction is required (UI:P) - i.e. a victim application must be made to open an attacker-supplied ZIP. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no weaponized public exploit is confirmed (a technical write-up exists on hackmd, but that is a disclosure analysis, not a confirmed exploit). Note a signal nuance: although PR:N indicates no privileges are needed, exploitation is still gated by the victim opening a malicious archive and, crucially, by the library being compiled in mmap mode - so the raw 'no privileges' metric overstates how easily this is reached in default deployments. Net assessment: a genuine but low-urgency DoS bug in a niche library, not a high-priority issue despite the medium CVSS.

An attacker crafts a malicious ZIP archive whose entry name ends exactly at the central-directory boundary, then induces a victim application built against an mmap-enabled zziplib to open it via zzip_dir_open(). The ineffective bounds check lets a 28-byte ZIP64 extra-field parse read past the mapped central directory, crashing the process (denial of service). A public technical write-up describing the flaw exists, but no confirmed weaponized exploit is identified.