zziplib CVE-2026-111142

Exploitation requires a victim application that uses zziplib's mmapped parsing path (e.g., zzip_disk_findfirst / zzip_disk_entry_strdup_name in zzip/mmapped.c) to open and process an attacker-supplied, crafted ZIP archive whose end-of-central-directory record places the first entry near the buffer end. The attack vector is local (AV:L) and requires passive user interaction (UI:P) - the target must actually load/parse the malicious file - with no authentication (PR:N). Limiting factors: the flaw only affects zziplib builds through 0.13.80 that reach the vulnerable mmapped code path, impact is confined to a crash (no RCE, no data disclosure per CVSS), and it cannot be triggered remotely without getting the malicious archive processed by the target.

This is a medium-severity (CVSS 4.0 base 6.8) denial-of-service issue, not a high-priority remote-exploitation threat. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) is self-consistent and tells the real story: the attack vector is LOCAL and requires passive user interaction (the victim application must open/parse an attacker-supplied ZIP), and the ONLY impact is availability (VA:H) - a crash - with no confidentiality (VC:N) or integrity (VI:N) impact. No EPSS score, no CISA KEV listing, and no explicit public-exploit flag were provided in the input, so exploitation likelihood cannot be quantified. There is a notable signal CONFLICT: the input Tags label this 'Information Disclosure', but the authoritative CVSS 4.0 vector rates confidentiality impact as none (VC:N) and CWE-125 (out-of-bounds READ) here manifests as an over-read that crashes the process rather than leaking data to the attacker - treat the disclosure framing as unverified. Net: a real but low-urgency bug most relevant to software that ingests untrusted ZIP archives using zziplib; prioritize patching where zziplib parses attacker-controlled files, but it does not warrant emergency response.

An attacker crafts a malicious ZIP whose end-of-central-directory record places the first entry near the buffer end, then delivers it to a victim application that extracts/parses archives with zziplib (e.g., via zzip_disk_findfirst). When the application processes the file, zzip_disk_entry_strdup_name reads past the heap buffer and the process crashes (DoS). A detailed public technical write-up describing how to trigger the condition exists, though no confirmed weaponized exploit code is indicated in the input.