zip2 (Rust crate) CVE-2026-115909

Exploitation requires an application running on a Unix or Windows target (the vulnerable branch is gated behind #[cfg(any(unix, windows))]) that calls ZipArchive::extract() on an attacker-supplied archive, using default features and no special configuration. The malicious archive must contain an entry whose external-attributes field sets the S_IFLNK bit (so is_symlink() returns true) and whose central-directory uncompressed_size - widened via a ZIP64 extended-information extra field - declares an impossibly large value (the PoC uses 2^62, which exceeds the 47-bit x86-64 user address space and aborts deterministically regardless of installed RAM or overcommit policy). Limiting factors: the target application must actually extract untrusted ZIPs, and only versions 1.3.0 through 8.x are affected (fixed in 9.0.0). Under a ulimit -v cap or a memory-constrained container the threshold drops low enough that a plain 32-bit uncompressed_size with no ZIP64 field suffices, so such limits lower the bar rather than mitigating the flaw. No authentication or user interaction beyond submitting the archive is needed.

All impact signals converge on availability only: the vendor CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 with C:N and I:N, and the GHSA advisory explicitly states no memory unsafety, no out-of-bounds access, no disclosure and no data corruption - this is a pure denial-of-service (CWE-400, with the advisory also citing CWE-789). The low attack complexity and lack of authentication or user interaction are credible: a single 112-byte archive aborts the process, the reporter verified the crash cannot be contained by catch_unwind, a worker thread, or a pre-flight check, and it is repeatable at will. The vuln.today priority is 'this_week' and a patch is available, which fits an easily-triggered but availability-only flaw rather than an emergency. No CISA KEV listing is present and no EPSS score was supplied in the input, so widespread-exploitation probability cannot be quantified from the data given - this should be read as missing data, not as evidence of low risk. The AV:N rating assumes the malicious archive reaches the application over a network path (upload handlers, mail attachments, artifact/package ingestion, backup restore, container-layer extraction are the advisory's named patterns); for purely local file processing the practical vector is closer to local delivery. Real priority is moderate-to-high for any service that extracts attacker-supplied ZIPs with zip2 1.3.0-8.x, and negligible for code paths that never call ZipArchive::extract on untrusted input.

An attacker uploads (or emails, or submits as a package/artifact) a 112-byte ZIP whose single entry carries the S_IFLNK symlink attribute and a ZIP64 extra field declaring an uncompressed size of 2^62 bytes. When the server calls ZipArchive::extract, the symlink branch calls Vec::with_capacity on that declared size before reading any data; the infallible allocation is refused and the process aborts with SIGABRT (exit 134). A working, reporter-verified proof-of-concept harness and base64 payload are published in the vendor advisory, and the crash can be replayed on demand to keep the service down.